CVE-2024-45802

What it actually does

Input validation flaws combined with improper resource management (premature and missing releases) allow a trusted server to trigger denial of service conditions in the caching proxy, affecting all connected clients.

Why it matters to the business

Organizations relying on the proxy for web traffic may experience service outages, impacting user productivity and requiring emergency maintenance with urgency due to high EPSS score and widespread use of Squid.

How an attack unfolds

An attacker controlling a server that clients access through the proxy sends specially crafted responses that exploit resource release bugs, leading to crashes or hangs; no named threat actors are associated with this issue.

How to fix it

Upgrade all instances to Squid version 6.10 or later; apply the fix from commit e071b58dfccdf8805fd32b7e4cce239ee12182d9 in the GIT repository for custom builds.

How to confirm the fix worked

Verify the installed Squid version is 6.10 or newer; confirm the commit hash is present in source builds and test proxy behavior against crafted server responses.

Typical attack path

1. Compromise or control a web server reachable by proxy clients
2. Craft malicious HTTP responses targeting the identified bugs
3. Ensure client traffic routes through the vulnerable Squid instance
4. Trigger repeated resource mismanagement to cause denial of service

How to detect it

Review system and proxy logs for unexpected process crashes, restarts, or resource exhaustion events correlated with traffic to external servers.

What your security team should do

• Immediately upgrade all Squid deployments to the fixed version due to elevated EPSS and publication over 700 days ago
• Audit configurations to limit exposure to untrusted external servers
• Implement monitoring for proxy instability and schedule validation testing