CVE-2024-37894

What it actually does

Out-of-bounds write during ESI variable assignment triggers memory corruption that crashes the Squid process.

Why it matters to the business

A successful attack can make the caching proxy unavailable, interrupting web traffic filtering, acceleration, and access for users and downstream systems; the low EPSS and absence from KEV indicate limited observed exploitation but the flaw still requires prompt attention given the 833 days since publication.

How an attack unfolds

An authenticated remote attacker crafts HTTP requests containing specially formed ESI directives that cause Squid to perform an out-of-bounds write when processing variable assignments, resulting in memory corruption and a denial-of-service crash.

How to fix it

Upgrade squid-cache/squid to the commit e071b58dfccdf8805fd32b7e4cce239ee12182d9 or later; rebuild and deploy the updated binary, then restart the service.

How to confirm the fix worked

Confirm the running Squid binary reports a commit newer than e071b58dfccdf8805fd32b7e4cce239ee12182d9; replay representative ESI requests in a test environment and verify the process remains stable.

Typical attack path

1. Identify a reachable Squid instance that processes ESI-enabled responses
2. Send crafted requests containing malicious ESI variable assignments
3. Trigger the out-of-bounds write and observe process termination
4. Repeat to sustain the denial-of-service condition

How to detect it

Monitor Squid process logs and system crash reports for segmentation faults or abrupt terminations immediately following receipt of ESI-related requests; correlate with proxy access logs for unusual variable assignments.

What your security team should do

• Apply the upstream fix immediately on all production proxies
• Disable ESI processing if the feature is not required
• Add monitoring for Squid process crashes and unexpected restarts
• Review firewall and access-control rules to limit exposure of management interfaces