CVE-2025-62168

Squid versions prior to 7.2 fail to redact HTTP authentication credentials in error handling, so credentials can be exposed via the debug data included in the administrator mailto links generated on Squid error pages. A remote client can trigger this to bypass browser security protections and learn the credentials a trusted client uses to authenticate. Attackers can also identify security tokens or credentials used internally by a web application that uses Squid for backend load balancing, notably without needing Squid itself to be configured with HTTP authentication. Any Squid deployment running a version before 7.2 is affected, including forward proxies, caching proxies, and load-balancing setups. No public proof-of-concept or confirmed in-the-wild exploitation is known, but the EPSS score of 62.9% (99th percentile) indicates a high probability of exploitation within 30 days.

What to do: Upgrade Squid to version 7.2 or later, which redacts authentication credentials from error output. Where upgrading is not immediately possible, set 'email_err_data off' in squid.conf to remove debug information from the administrator mailto links on error pages. Operators using Squid for backend load balancing should check what credentials or security tokens the web application sends through the proxy, since those are at risk of disclosure.