CVE-2024-25617: Squid HTTP header parsing denial of service via oversized headers

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 high severity with network reachability, no authentication or interaction needed, and a very high EPSS score, though impact is limited to denial of service.

What it is

Squid, the open source caching proxy, mishandles oversized HTTP headers due to a Collapse of Data into Unsafe Value bug in header parsing. A remote client or remote server can send oversized headers to trigger a denial of service. In Squid versions before 6.5 this works with default request_header_max_size and reply_header_max_size settings; 6.5 changed the defaults to safe values.

Impact

An attacker can cause a denial of service, disrupting proxy availability for all users relying on the affected Squid instance. There is no confidentiality or integrity impact; only availability is affected.

Attack surface

Reachable over the network by any remote client or remote server that can send HTTP messages to the proxy, with no authentication or user interaction required (CVSS vector AV:N/AC:L/PR:N/UI:N). Exploitation depends on the header size limits being at unsafe values, which is the default in versions prior to 6.5.

Exploitation

Not listed in CISA KEV and no ransomware usage documented, but EPSS is very high at 0.88094 (99.758th percentile), indicating substantial predicted exploitation activity. References include patch and vendor advisory links, with no public exploit tag present in the record.

What to do

• Upgrade Squid to version 6.5 or later, which sets safe defaults for request_header_max_size and reply_header_max_size.
• If upgrade is not immediately possible, manually set request_header_max_size and reply_header_max_size to safe values and watch cache.log for the critical warning Squid emits when unsafe values are configured.
• Apply the vendor patch commit referenced in the advisory for environments that cannot move to 6.5.
• For NetApp BlueXP deployments, apply the fixes in NetApp advisory ntap-20240322-0006.
• Monitor cache.log for the critical warning about unsafe header size settings as an ongoing control.

Detection

• Alert on the Squid cache.log critical warning indicating request_header_max_size or reply_header_max_size are set to unsafe values.
• Monitor proxy availability and restart patterns for unexplained outages consistent with header-parsing resource exhaustion.
• Inspect HTTP traffic for abnormally large header blocks sent to or from the proxy.
• Track Squid version inventory to identify instances still running versions prior to 6.5.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.