CVE-2023-46728

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid. This issue may lead to a remote denial of service via gopher URL requests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, create an access list configuration to reject all gopher URL requests:

Set ACL directives in your squid.conf file (or equivalent) as follows: acl gopher proto gopher http_access deny gopher

Important: This sequence must be placed above any lines starting with "http_access allow" in your configuration. Observation: Some loss of performance may occur with this configuration.