CVE-2025-54574
9.3
CRITICAL · CVSS 3.1 · EPSS 23.7% (pctl 98)
Patch early
EPSS 23.7% — above the 10% action threshold.
Description
Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.
Scoring
| CVSS | 9.3 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H |
| EPSS | 23.69% — more likely to be exploited than 98% of all CVEs |
| Weakness | CWE-122 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2025-08-01 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| squid-cache | squid |
References
- https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
- https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
- https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
- http://www.openwall.com/lists/oss-security/2025/11/05/5
- https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
→ the Explorer · watch your stack · NVD