CVE-2024-25111: Squid HTTP chunked decoder recursion denial of service

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityRemote, unauthenticated denial of service with a high EPSS score and no workaround, though it only affects availability.

What it is

Squid versions 3.5.27 through 6.7 contain an uncontrolled recursion bug in the HTTP chunked decoder. A remote attacker can send a crafted chunked-encoded HTTP message that drives deep recursion and causes a denial of service. The flaw is fixed in Squid 6.8, and no workaround exists.

Impact

An attacker can crash or exhaust the Squid proxy process, disrupting web access for all users relying on it. Only availability is affected; there is no confidentiality or integrity impact.

Attack surface

Reachable over the network by sending a crafted chunked HTTP message to the Squid proxy, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is high at roughly 0.65 (99th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Squid to version 6.8 or later.
• Apply the vendor patch SQUID-2024_1 for stable release branches that cannot move to 6.8.
• Update distribution packages (Fedora, Debian LTS) and NetApp BlueXP components that bundle Squid.
• Restrict or monitor direct access to Squid proxy ports from untrusted networks.
• Plan for service interruption since no configuration workaround exists.

Detection

• Monitor Squid logs for crashes, restarts, or abnormal termination of the proxy process.
• Alert on high CPU or memory spikes in Squid correlated with chunked transfer-encoded requests.
• Inspect proxy access logs for malformed or unusually deep chunked HTTP messages from single sources.
• Track repeated connection attempts to the proxy port that precede service unavailability.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.