CVE-2023-50269: Squid proxy uncontrolled recursion in HTTP request parsing causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network reachability, no authentication, and high EPSS percentile make this a serious availability risk for exposed Squid proxies, though it is not in KEV.

What it is

Squid versions 2.6 through 2.7.STABLE9, 3.1 through 5.9, and 6.0.1 through 6.5 contain an uncontrolled recursion flaw (CWE-674) in HTTP request parsing. A remote client can trigger deep recursion by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is enabled, causing a denial of service. The issue is fixed in Squid 6.6 and via patches for stable releases.

Impact

An unauthenticated remote attacker can crash or exhaust the Squid process, disrupting proxy service for all users behind it. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reachable over the network via HTTP requests to the Squid proxy; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The attack only works when the follow_x_forwarded_for feature is configured.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented; EPSS is high at roughly 0.576 (99th percentile), indicating elevated likelihood of exploitation activity, but the record does not confirm public exploit code.

What to do

• Upgrade Squid to version 6.6 or later.
• If immediate upgrade is not possible, apply the vendor patches for the relevant stable branch (SQUID-2023_10.patch for v5 and v6).
• Disable or restrict the follow_x_forwarded_for feature where it is not operationally required.
• Limit or sanitize X-Forwarded-For header size and depth at the proxy or upstream load balancer.
• Monitor Squid processes for crashes or restarts and apply vendor updates from Debian, Fedora, or NetApp advisories as applicable.

Detection

• Alert on unusually large or deeply nested X-Forwarded-For headers in proxy access or request logs.
• Monitor Squid process crashes, core dumps, or unexpected restarts correlated with HTTP request bursts.
• Track resource exhaustion (CPU/memory) on Squid hosts during periods of high request volume.
• Use network monitoring to detect repeated requests with oversized X-Forwarded-For values from single sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.