CVE-2023-49288

squid: Use-After-Free in the HTTP Collapsed Forwarding Feature

Loading…

Severity

Moderate

Red Hat Product Security

7.5

CVSS 3.1

Review impact separately from score.

Published · December 5, 2023

Updated · November 21, 2025

Description

A flaw was found in Squid. The use of the HTTP Collapsed Forwarding configuration may allow an attacker to perform a denial of service remotely.

Statement

Collapsed Forwarding features are only used in Squid for accelerator servers and is not enabled by default, lowering the severity of this flaw to Moderate.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

To mitigate this issue, lines for the 'collapsed_forwarding' feature have to be removed from your squid.conf.

CVSS / CWE

CVSS 3.1 · 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-416 · Use After Free