Denial of Service Vulnerability in Squid HTTP Caching Proxy

squid Updated 02 Oct 2025

Summary

09/02/2018

Disclosed on

N/A

Severity

Yes i

Fix available

High

Severity

7.5

CVSS Score

ALPINE-CVE-2018-1000024: The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clie... Affects squid versions < 3.5.27-r2. Fixed in 3.5.27-r2. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Squid is a widely used caching proxy for the web that supports HTTP, HTTPS, and FTP protocols. It is designed to improve web performance by caching frequently requested content, thereby reducing bandwidth and improving response times. However, certain versions of Squid have been found to be vulnerable to an Incorrect Pointer Handling issue in ESI Response Processing, which can lead to Denial of Service (DoS) for clients using the proxy.

Vulnerability Detail

The vulnerability identified as CVE-2018-1000024 affects Squid versions 3.0 to 3.5.27 and 4.0 to 4.0.22. It arises from improper handling of pointers during the processing of ESI (Edge Side Includes) responses. An attacker can exploit this vulnerability by delivering an HTTP response payload containing valid but unusual ESI syntax, which can cause the Squid proxy to crash, resulting in a Denial of Service for all clients relying on the proxy. The vulnerability has a CVSS score of 7.5, indicating a high severity level.

How To Fix

Minimum fixed version

3.5.27-r2

This is the first release that contains the fix.

sudo apk add --upgrade squid

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

As a temporary workaround, you can disable ESI processing in the Squid configuration by adding the following line to your squid.conf file: 'esi off'. This will prevent the proxy from processing ESI responses, mitigating the risk until the package can be updated.

Conclusion

The Denial of Service vulnerability in Squid HTTP Caching Proxy poses a significant risk to users of affected versions. It is crucial to update to the patched version to mitigate this risk. Additionally, using Vulert can help monitor for such vulnerabilities in your applications.

See every vulnerability recorded for squid →