CVE-2025-54574: Squid-cache Squid RCE Vulnerability

CVE-2025-54574 Overview

CVE-2025-54574 is a heap buffer overflow vulnerability in Squid, a widely-deployed caching proxy for the web. The vulnerability exists in versions 6.3 and below, where incorrect buffer management during URN (Uniform Resource Name) processing can lead to heap memory corruption and potentially enable remote code execution. Attackers can exploit this flaw by sending specially crafted URN requests to vulnerable Squid proxy instances.

Critical Impact

This vulnerability allows unauthenticated remote attackers to potentially achieve remote code execution on Squid proxy servers through malicious URN requests, compromising network infrastructure and potentially enabling lateral movement within corporate networks.

Affected Products

• Squid-cache Squid versions 6.3 and below
• Systems running vulnerable Squid proxy instances with URN access permissions enabled
• Network infrastructure relying on Squid for web caching and proxy services

Discovery Timeline

• 2025-08-01 - CVE-2025-54574 published to NVD
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2025-54574

Vulnerability Analysis

This heap buffer overflow vulnerability (CWE-122, CWE-787) occurs during the processing of URN requests in Squid proxy. The flaw stems from improper buffer management in the HTTP reply parsing functionality, where boundary conditions are not correctly validated when handling URN data. When a maliciously crafted URN request is processed, the application writes data beyond the allocated heap buffer boundaries, corrupting adjacent memory structures.

The vulnerability requires no authentication and can be triggered remotely over the network with no user interaction required. An attacker exploiting this vulnerability could achieve complete system compromise, affecting the confidentiality, integrity, and availability of the target system.

Root Cause

The root cause lies in incorrect buffer management within Squid's URN processing code path. Specifically, the HTTP reply parsing functionality failed to properly validate buffer boundaries when serializing HTTP headers during storeClientCopy() operations. The fix introduces additional parsing safety mechanisms through parseTerminatedPrefix() to properly handle buffer sizes while respecting reply_header_max_size constraints.

Attack Vector

The attack vector is network-based, requiring an attacker to send specially crafted URN requests to a vulnerable Squid proxy server. The exploitation flow involves:

1. Attacker identifies a Squid proxy server running version 6.3 or below with URN access enabled
2. Crafted URN request is sent to the proxy server
3. The malformed request triggers the heap buffer overflow during URN processing
4. Memory corruption occurs, potentially allowing code execution in the context of the Squid process

The security patch introduces improved buffer handling in the HTTP reply parsing code:

    /// parses reply header using Parser
    bool parseHeader(Http1::Parser &hp);

    /// Parses response status line and headers at the start of the given
    /// NUL-terminated buffer of the given size. Respects reply_header_max_size.
    /// Assures pstate becomes Http::Message::psParsed on (and only on) success.
    /// \returns the number of bytes in a successfully parsed prefix (or zero)
    /// \retval 0 implies that more data is needed to parse the response prefix
    size_t parseTerminatedPrefix(const char *, size_t);

private:
    /** initialize */
    void init();

Source: GitHub Squid Commit

Detection Methods for CVE-2025-54574

Indicators of Compromise

• Unexpected Squid proxy crashes or service restarts indicating potential exploitation attempts
• Anomalous URN-related requests in Squid access logs with malformed or unusually long URN strings
• Memory corruption indicators in Squid error logs or system crash dumps
• Unusual outbound network connections from the Squid proxy host suggesting post-exploitation activity

Detection Strategies

• Monitor Squid access logs for unusual URN request patterns or abnormally large URN payloads
• Implement network intrusion detection rules to identify malformed URN requests targeting Squid proxies
• Deploy memory corruption detection tools and monitor for heap overflow signatures
• Use SentinelOne Singularity to detect exploitation attempts and post-compromise behaviors

Monitoring Recommendations

• Enable verbose logging on Squid proxy servers to capture detailed request information
• Configure alerting for Squid service crashes or unexpected restarts
• Monitor network traffic to and from Squid proxy servers for anomalous patterns
• Implement host-based monitoring for suspicious process spawning from Squid processes

How to Mitigate CVE-2025-54574

Immediate Actions Required

• Upgrade Squid to version 6.4 or later which contains the security fix
• Disable URN access permissions in Squid configuration as an immediate workaround if patching is not immediately possible
• Review and restrict network access to Squid proxy servers to trusted sources only
• Implement network segmentation to limit potential lateral movement if compromise occurs

Patch Information

The vulnerability has been fixed in Squid version 6.4. The patch addresses the buffer management issues in the HTTP reply parsing functionality by introducing proper boundary validation through the parseTerminatedPrefix() function. Organizations should upgrade to the fixed version as soon as possible. For detailed patch information, refer to the GitHub Security Advisory and the Squid 6.4 Release.

Workarounds

• Disable URN access permissions in Squid configuration until patching can be completed
• Implement access control lists (ACLs) to restrict which clients can make URN requests
• Deploy a web application firewall (WAF) or reverse proxy to filter malicious URN requests before they reach Squid
• Consider temporarily disabling Squid if URN functionality is not critical to operations

# Configuration example - Disable URN access in squid.conf
# Add or modify the following ACL rules to deny URN requests
acl URN_deny urlpath_regex ^urn:
http_access deny URN_deny

# Reload Squid configuration
squid -k reconfigure