CVE-2024-45802

CVE-2024-45802 combines input-validation, premature resource-release, and missing resource-release flaws in Squid, the widely used open-source caching proxy. It is triggered remotely when a server that the proxy fetches content from — i.e., any 'trusted' upstream server contacted on behalf of clients — sends responses that mishandle Squid's resource lifecycle, with no privileges or user interaction required. An attacker gains denial of service: the proxy's availability is disrupted for all clients that depend on it (CVSS availability impact: high; no confidentiality or integrity impact). Anyone running an affected Squid deployment as a forward, intercept, or caching proxy is exposed, until the fix in the default build configuration of Squid 6.10. As of now there is no known public proof-of-concept and it is not in CISA KEV, but EPSS puts the 30-day exploitation probability at about 48% (99th percentile), indicating elevated risk.

What to do: Upgrade Squid to version 6.10 or later, and verify your build configuration since the fix is described as applying to the default build; if you run Squid packaged by a distribution or appliance vendor, check for a backported security update. Until patched, consider limiting which upstream servers clients can reach through the proxy and monitor proxy availability and memory/connection usage for signs of resource exhaustion. Note the high EPSS score and re-check for emerging PoCs or in-the-wild activity.