CVE-2020-24606

—

CVSS 3.1

7.5 high

EPSS

5%p92

Published

Aug 24, 2020 (Aug 24, 2020)

Modified

Jun 17, 2026

Description

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

Vendors: squid-cache canonical debian fedoraproject opensuse
Products: squid, ubuntu linux, debian linux, fedora, leap
Weakness: CWE-667
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (5.2%)

In the news0 stories

No ingested article mentions this CVE yet.