Vulnerability record · CVE-2014-7141 · published 26 November 2014
CVE-2014-7141: Squid pinger out-of-bounds read via crafted ICMP/ICMP6 packet
Squid Cache · Squid
Squid 3.x before 3.4.8 contains an out-of-bounds read in the pinger component when it processes a crafted ICMP or ICMP6 packet type. The flaw can leak sensitive information or crash the process, affecting proxy availability and potentially exposing memory contents. It is remotely reachable without authentication.
Description
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.
AV:N/AC:L/Au:N/C:P/I:N/A:P
Automated analysis
high priorityThe flaw is remotely reachable without authentication and has a very high EPSS score, though it is not known to be actively exploited and only causes partial confidentiality and availability impact.
What it is
Squid 3.x before 3.4.8 contains an out-of-bounds read in the pinger component when it processes a crafted ICMP or ICMP6 packet type. The flaw can leak sensitive information or crash the process, affecting proxy availability and potentially exposing memory contents. It is remotely reachable without authentication.
Impact
An unauthenticated remote attacker can read out-of-bounds memory, potentially disclosing sensitive data, or crash the pinger and disrupt Squid service.
Attack surface
Reached over the network by sending crafted ICMP or ICMP6 packets to a host running the vulnerable Squid pinger; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no public exploit tags appear in the references, though EPSS is high at 0.76064 (99.5th percentile), indicating elevated predicted exploitation likelihood.
What to do
- Upgrade Squid to 3.4.8 or later, or apply the vendor patch referenced in SQUID-2014_4 and USN-2422-1.
- If patching is delayed, restrict ICMP/ICMP6 reachability to the pinger to trusted networks and disable the pinger if it is not required.
- Monitor vendor advisories for the specific distribution package and apply the corresponding update.
- Segment or firewall proxy hosts so untrusted networks cannot send ICMP/ICMP6 traffic directly to them.
Detection
- Monitor Squid pinger process crashes or unexpected restarts in system and Squid logs.
- Alert on anomalous ICMP/ICMP6 packet types or volumes directed at proxy hosts.
- Review core dumps or crash reports from the pinger for out-of-bounds read indicators.
- Track host-level memory disclosure symptoms or unusual process termination on Squid servers.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-7141 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-7141), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
