Critical Information Disclosure Vulnerability in Squid Proxy Server
Summary
RLSA-2025:21002: Important: squid security update. Affects squid versions < 7:6.10-6.el10_1.1. Fixed in 7:6.10-6.el10_1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Squid is a high-performance proxy caching server designed for web clients, supporting various protocols including FTP and HTTP. It is widely used to improve web performance by caching frequently accessed content, reducing bandwidth usage, and enhancing user experience. However, Squid has been found to have a significant security vulnerability that could lead to the leakage of sensitive authentication credentials during error handling processes.
Vulnerability Detail
The vulnerability identified as CVE-2025-62168 allows for information disclosure through improper handling of authentication credentials in error messages. When an error occurs, sensitive information, including user credentials, may be inadvertently exposed. This can lead to unauthorized access and exploitation of user accounts, posing a serious risk to data security and privacy.
How To Fix
Minimum fixed version
7:6.10-6.el10_1.1
This is the first release that contains the fix.
sudo dnf update squidTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the Squid server and implement stricter error handling to avoid exposing sensitive information in error messages. This can be done by configuring the Squid settings to suppress detailed error messages that may contain sensitive data.
Conclusion
The Squid proxy server has a critical vulnerability (CVE-2025-62168) that can lead to information disclosure of authentication credentials. It is crucial for users to update to the latest patched version to secure their systems against potential exploitation. Implementing workarounds can provide temporary relief, but updating is the best course of action.
See every vulnerability recorded for squid →
FAQ
CVE-2025-62168 is a vulnerability in the Squid proxy server that allows for information disclosure of authentication credentials during error handling.
This vulnerability can lead to unauthorized access to user accounts if sensitive authentication information is leaked through error messages.
You should update your Squid installation to the patched version (7:6.10-6.el10_1.1 or later) as soon as possible to mitigate the risk.
Yes, you can use Vulert, which allows you to monitor and alert for open-source vulnerabilities in your software using just a manifest file. You can check your application at the Vulert playground without signing up.
The CVSS score for this vulnerability is 8.6, indicating a high level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for squid.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
