CVE-2025-54574

Squid, a widely used open-source web caching proxy, contains a heap-based buffer overflow (CWE-122, out-of-bounds write CWE-787) in its handling of URN requests, caused by incorrect buffer management in versions 6.3 and below. A remote, unauthenticated attacker can trigger the flaw by sending crafted URN traffic to a vulnerable Squid instance over the network, with no privileges or user interaction required per the CVSS 9.8 (critical) vector. Successful exploitation could lead to remote code execution with the privileges of the Squid process, with high impact on confidentiality, integrity, and availability. Any deployment running Squid 6.3 or earlier is affected, especially proxies exposed to untrusted networks, and the issue is fixed in Squid 6.4 with a workaround of disabling URN access permissions. There is no known in-the-wild exploitation, public PoC, or KEV listing yet, but the ~22% EPSS score (98th percentile) indicates an elevated probability of exploitation within the next 30 days.

What to do: Upgrade to Squid 6.4 or later as soon as possible. Where an immediate upgrade is not feasible, apply the vendor workaround by disabling URN access permissions in the Squid configuration. Prioritize patching internet-facing Squid instances, since the flaw is remotely exploitable without authentication and no PoC is required for motivated attackers.