Introduction
A single malformed HTTP response can crash or compromise a Squid proxy, disrupting web access for thousands or exposing sensitive data. CVE-2025-54574 is a critical flaw in Squid's URN processing, and it affects every deployment running version 6.3 or earlier. Squid is an open source proxy and caching server, widely used by enterprises, ISPs, and universities to speed up and secure web traffic. Because it runs in so many networks worldwide, a vulnerability like this one has operational and security consequences far beyond a single site.
Technical Information
CVE-2025-54574 is a heap buffer overflow in Squid's handling of Uniform Resource Names (URNs). The flaw is present in all Squid versions up to and including 6.3. Its cause is improper buffer management when Squid processes Trivial-HTTP responses to URN requests. While processing a URN, Squid may read partial HTTP headers from disk without adequate bounds checking, and can then write beyond allocated heap memory.
An attacker can exploit this by crafting HTTP responses with oversized headers. When Squid processes such a response, its internal routines (notably storeClientCopy()) may mishandle buffer boundaries and corrupt heap memory. The result can be denial of service, information disclosure (up to 4KB of heap memory), or remote code execution if the attacker can control the overflow data.
The patch (commit a27bf4b84da23594150c7a86a23435df0b35b988) corrects buffer management in the affected code paths, so serialized HTTP response header bytes are no longer improperly sent or exposed.
Proof of Concept
A proof-of-concept (PoC) exploit for the flaw fixed in commit a27bf4b84da23594150c7a86a23435df0b35b988 would involve crafting HTTP responses with oversized headers. Sent to a Squid proxy, those responses could make it read partial HTTP headers from disk and fail to parse them. That could result in denial of service or other unintended behavior. The commit changes the storeClientCopy() function so it no longer sends serialized HTTP response header bytes, which mitigates the issue.
Reference: Squid Commit a27bf4b
Patch Information
The Squid development team has fixed this critical URN buffer overflow in version 6.4. In earlier versions, the flaw could allow a remote server to execute arbitrary code by exploiting improper buffer management during URN processing.
The patch corrects the buffer management, which prevents the heap buffer overflow. When Squid processes URN Trivial-HTTP responses, it no longer risks exposing up to 4KB of allocated heap memory to clients. Without the fix, that exposure could have disclosed sensitive information, including security credentials.
For stable releases, the Squid team has provided specific patches. The Squid 6 patch is commit a27bf4b.
Administrators need to apply these patches promptly. If you run a prepackaged version of Squid, ask your package vendor whether updated packages are available.
All Squid versions up to and including 6.3 are vulnerable. Upgrading to version 6.4 or applying the relevant patches will secure your system against this issue.
Reference: Squid Security Advisory GHSA-w4gv-vw3f-29g3
Affected Systems and Versions
- Squid Proxy versions up to and including 6.3 are affected
- Vulnerable in default configurations where URN processing is enabled
- Fixed in version 6.4
Vendor Security History
Squid has fixed URN-related vulnerabilities before, such as SQUID-2021:1 (CVE-2021-28651), which also involved parsing issues in URN handling. The project has a consistent record of publishing advisories and patches for critical vulnerabilities. Its response to CVE-2025-54574 was prompt, with a new release and detailed guidance shortly after discovery.
