CVE-2023-46724

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

Database specific

{
    "cwe_ids": [
        "CWE-125",
        "CWE-1285",
        "CWE-129",
        "CWE-786",
        "CWE-823"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46724.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

b6bc3157c337458cd6615fd2120fa5446f82d1c3

Fixed

1d8175b27fc1c347649d4f221ff2633e8d800429

Fixed

b70f864940225dfe69f9f653f948e787f99c3810

Database specific

{
    "cpe": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "3.3.0.1"
        },
        {
            "fixed": "6.4"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46724.json"

vanir_signatures

[
    {
        "digest": {
            "length": 944.0,
            "function_hash": "210215246844197458567831775363745291472"
        },
        "source": "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2023-46724-2913b03e",
        "signature_version": "v1",
        "target": {
            "file": "src/anyp/Uri.cc",
            "function": "matchDomainName"
        }
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "132297003046321410898293712443124375497",
                "141294028970175884415189950830511831259",
                "83365289692056968680299252530166654273",
                "263561776175962430572252611013012687107",
                "163679156619555015851941026236844524402",
                "182953648326232214989768464638856171680",
                "337849282034998695637314799915579350143"
            ]
        },
        "source": "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "deprecated": false,
        "signature_type": "Line",
        "id": "CVE-2023-46724-6184ef0f",
        "signature_version": "v1",
        "target": {
            "file": "src/anyp/Uri.cc"
        }
    },
    {
        "digest": {
            "length": 1833.0,
            "function_hash": "5004815670061213126088965192724588639"
        },
        "source": "https://github.com/squid-cache/squid/commit/b70f864940225dfe69f9f653f948e787f99c3810",
        "deprecated": false,
        "signature_type": "Function",
        "id": "CVE-2023-46724-c474f5d2",
        "signature_version": "v1",
        "target": {
            "file": "src/anyp/Uri.cc",
            "function": "urlInitialize"
        }
    }
]

vanir_signatures_modified

"2026-07-15T01:35:58Z"