{"id":"CVE-2023-46847","title":"Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.","summary":"Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.","severity":"high","cvss":8.6,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","cwe":["CWE-120","CWE-120"],"vendor":"squid-cache","product":"squid","affected":["squid >= 3.2.0.1, < 6.4","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux_eus = 8.6","enterprise_linux_eus = 8.8","enterprise_linux_eus = 9.0","enterprise_linux_eus = 9.2","enterprise_linux_for_arm_64 = 8.0_aarch64","enterprise_linux_for_ibm_z_systems = 8.0_s390x","enterprise_linux_for_power_little_endian = 8.0_ppc64le","enterprise_linux_server = 7.0","enterprise_linux_server_aus = 8.2","enterprise_linux_server_aus = 8.4","enterprise_linux_server_aus = 8.6","enterprise_linux_server_aus = 9.2","enterprise_linux_server_tus = 8.2","enterprise_linux_server_tus = 8.4","enterprise_linux_server_tus = 8.6","enterprise_linux_server_tus = 8.8","enterprise_linux_server_tus = 9.2","enterprise_linux_workstation = 7.0"],"patched":["squid 6.4"],"published":"2023-11-03","updated":"2026-08-07","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-46847","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:6266","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6267","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6268","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6748","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6801","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6803","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6804","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6805","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6810","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6882","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6884","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7213","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7576","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:7578","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2023-46847","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245916","label":"secalert@redhat.com"},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2023:6266","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6267","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6268","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6748","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6801","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6803","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6804","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6805","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6810","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6882","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:6884","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7213","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7576","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/errata/RHSA-2023:7578","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://access.redhat.com/security/cve/CVE-2023-46847","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245916","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://security.netapp.com/advisory/ntap-20231130-0002/","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd"],"epss":0.88351,"epssPercentile":0.99768,"ingestedAt":"2026-08-07T03:08:52.414Z","slug":"CVE-2023-46847","body":"## Overview\n\nSquid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.\n\n## Affected\n\n- `squid >= 3.2.0.1, < 6.4`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux_eus = 8.6`\n- `enterprise_linux_eus = 8.8`\n- `enterprise_linux_eus = 9.0`\n- `enterprise_linux_eus = 9.2`\n- `enterprise_linux_for_arm_64 = 8.0_aarch64`\n- `enterprise_linux_for_ibm_z_systems = 8.0_s390x`\n- `enterprise_linux_for_power_little_endian = 8.0_ppc64le`\n- `enterprise_linux_server = 7.0`\n- `enterprise_linux_server_aus = 8.2`\n- `enterprise_linux_server_aus = 8.4`\n- `enterprise_linux_server_aus = 8.6`\n- `enterprise_linux_server_aus = 9.2`\n- `enterprise_linux_server_tus = 8.2`\n- `enterprise_linux_server_tus = 8.4`\n- `enterprise_linux_server_tus = 8.6`\n- `enterprise_linux_server_tus = 8.8`\n- `enterprise_linux_server_tus = 9.2`\n- `enterprise_linux_workstation = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `squid 6.4`","depth":"twilight","depthScore":65,"depthScoreParts":{"impact":47.3,"likelihood":17.7,"exploitation":0,"ransomware":0},"changes":[]}