CVE-2023-5824: Squid-cache Squid DOS Vulnerability

CVE-2023-5824 Overview

A denial of service vulnerability exists in Squid proxy server related to improper handling of HTTP response header validation during caching operations. The flaw occurs because limits applied for validation of HTTP response headers are enforced before caching, but Squid may grow a cached HTTP response header beyond the configured maximum size. When a large header is subsequently retrieved from the disk cache, it causes the worker process to stall or crash, resulting in a denial of service condition.

Critical Impact
This vulnerability allows remote attackers to cause a denial of service by triggering worker process crashes through oversized cached HTTP response headers, potentially disrupting proxy services for all dependent clients.

Affected Products

Squid-cache Squid (all versions prior to patched releases)
Red Hat Enterprise Linux 6.0
Red Hat Enterprise Linux 7.0
Red Hat Enterprise Linux 8.0
Red Hat Enterprise Linux 9.0

Discovery Timeline

November 3, 2023 - CVE-2023-5824 published to NVD
November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2023-5824

Vulnerability Analysis

This vulnerability is classified under CWE-755 (Improper Handling of Exceptional Conditions). The core issue lies in a disconnect between the validation phase and the caching phase of HTTP response header processing in Squid.

During normal operation, Squid enforces size limits on HTTP response headers to prevent resource exhaustion and ensure stable proxy operation. However, the validation checks are performed before the response is written to the disk cache. This creates a race condition where headers that initially pass validation can grow beyond the configured maximum size while being stored in the cache.

When Squid later attempts to retrieve these oversized headers from disk cache, the worker process encounters an exceptional condition it cannot properly handle. The process either stalls indefinitely while trying to process the malformed cached data, or crashes outright due to memory allocation failures or buffer handling issues.

The network-based attack vector means any remote attacker who can send requests through the affected Squid proxy can potentially trigger this condition. No authentication is required, making this vulnerability particularly dangerous in environments where Squid serves as a public-facing proxy.

Root Cause

The root cause is improper exception handling in Squid's cache management subsystem. The header size validation logic operates independently from the cache storage mechanism, creating an inconsistency where cached objects can exceed the limits that are supposed to be enforced. When these oversized objects are retrieved, the code path lacks proper bounds checking and error handling, leading to process instability.

Attack Vector

An attacker can exploit this vulnerability by crafting HTTP requests that result in responses with headers that grow beyond configured limits during the caching process. The attack requires network access to the Squid proxy and can be executed without any user interaction or special privileges.

The attacker sends specially crafted requests through the vulnerable Squid proxy server. When the proxy caches responses with headers that exceed size limits, subsequent cache retrievals trigger the denial of service. This can disrupt service for all clients relying on the proxy for network access.

Detection Methods for CVE-2023-5824

Indicators of Compromise

Unexpected Squid worker process crashes or restarts in system logs
Increased frequency of SIGABRT or SIGSEGV signals in Squid process logs
Disk cache files containing abnormally large header objects
Service unavailability patterns coinciding with cache retrieval operations

Detection Strategies

Monitor Squid access and cache logs for unusual patterns in response header sizes
Implement process monitoring to detect frequent worker process restarts
Use network traffic analysis to identify requests targeting cache manipulation
Deploy SentinelOne agents to detect abnormal process behavior and crash patterns

Monitoring Recommendations

Configure alerts for Squid service interruptions and automatic restarts
Monitor cache directory for files exceeding expected header size thresholds
Track worker process CPU and memory utilization for anomalies
Review system logs for OOM (Out of Memory) events related to Squid processes

How to Mitigate CVE-2023-5824

Immediate Actions Required

Apply vendor-provided security patches for Squid immediately
For Red Hat Enterprise Linux systems, apply the relevant RHSA security updates
Consider temporarily disabling disk caching if patching is not immediately possible
Review and reduce reply_header_max_size configuration to minimize exposure

Patch Information

Multiple vendors have released security patches addressing this vulnerability:

Squid Project: Review the GitHub Security Advisory GHSA-543m-w2m2-g255 for official patch information
Red Hat Enterprise Linux: Multiple security advisories have been published including RHSA-2023:7465, RHSA-2023:7668, RHSA-2024:0072, RHSA-2024:0397, RHSA-2024:0771, RHSA-2024:0772, RHSA-2024:0773, and RHSA-2024:1153
NetApp: Refer to NetApp Security Advisory ntap-20231130-0003 for affected NetApp products
Debian: See the Debian LTS Announcement for Debian-specific updates

Workarounds

Disable disk caching temporarily by setting cache_dir to none in squid.conf
Implement rate limiting on incoming requests to reduce cache manipulation attempts
Deploy a web application firewall (WAF) to filter suspicious requests
Consider using memory-only caching as an interim measure until patching is complete

bash

# Temporary mitigation: Disable disk caching
# Edit /etc/squid/squid.conf and comment out or modify cache_dir
# cache_dir ufs /var/spool/squid 100 16 256

# Reduce reply header max size
reply_header_max_size 32 KB

# Restart Squid after configuration changes
systemctl restart squid