Critical Information Disclosure Vulnerability in Squid Proxy Server
Summary
ALSA-2025:20935: Important: squid security update. Affects squid versions < 7:5.5-22.el9_7.1. Fixed in 7:5.5-22.el9_7.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Squid is a high-performance proxy caching server designed for web clients, which supports various protocols including FTP and HTTP. It is widely used to improve web performance by caching frequently requested content, thus reducing bandwidth usage and improving response times. However, Squid has been found to have a vulnerability that can lead to the leakage of sensitive authentication credentials during error handling processes.
Vulnerability Detail
The vulnerability identified as CVE-2025-62168 allows for information disclosure through improper handling of authentication credentials in error messages. This flaw can potentially expose sensitive user information, leading to unauthorized access or exploitation by malicious actors. The issue arises from the way Squid processes errors related to authentication, which may inadvertently reveal credentials to unauthorized users.
How To Fix
Minimum fixed version
7:5.5-22.el9_7.1
This is the first release that contains the fix.
sudo dnf update squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Squid server by implementing stricter firewall rules or by configuring access control lists (ACLs) to restrict who can view error messages. This can help mitigate the risk of credential leakage until the package is updated.
Conclusion
The Squid proxy server has a critical vulnerability that can lead to information disclosure through improper error handling of authentication credentials. It is essential for users to update to the latest patched version to protect against potential exploitation. Additionally, implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for squid →
FAQ
CVE-2025-62168 is a vulnerability in the Squid proxy server that allows for information disclosure via authentication credential leakage during error handling.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without any installation.
The vulnerability can lead to unauthorized access to sensitive user information, which may be exploited by attackers to gain control over user accounts or systems.
Yes, a patch is available in the updated version of the Squid package. Users should update to version 7:5.5-22.el9_7.1 or later to mitigate the risk.
If immediate updating is not possible, implement stricter access controls and firewall rules to limit exposure to the vulnerability until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
