--- id: CVE-2023-46847 title: >- Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. summary: >- Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. severity: high cvss: 8.6 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H' cwe: - CWE-120 - CWE-120 vendor: squid-cache product: squid affected: - 'squid >= 3.2.0.1, < 6.4' - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux_eus = 8.6 - enterprise_linux_eus = 8.8 - enterprise_linux_eus = 9.0 - enterprise_linux_eus = 9.2 - enterprise_linux_for_arm_64 = 8.0_aarch64 - enterprise_linux_for_ibm_z_systems = 8.0_s390x - enterprise_linux_for_power_little_endian = 8.0_ppc64le - enterprise_linux_server = 7.0 - enterprise_linux_server_aus = 8.2 - enterprise_linux_server_aus = 8.4 - enterprise_linux_server_aus = 8.6 - enterprise_linux_server_aus = 9.2 - enterprise_linux_server_tus = 8.2 - enterprise_linux_server_tus = 8.4 - enterprise_linux_server_tus = 8.6 - enterprise_linux_server_tus = 8.8 - enterprise_linux_server_tus = 9.2 - enterprise_linux_workstation = 7.0 patched: - squid 6.4 published: '2023-11-03' updated: '2026-08-07' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-46847' references: - url: 'https://access.redhat.com/errata/RHSA-2023:6266' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6267' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6268' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6748' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6801' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6803' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6804' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6805' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6810' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6882' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6884' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7213' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7576' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:7578' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2023-46847' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245916' label: secalert@redhat.com - url: >- https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2023:6266' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6267' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6268' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6748' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6801' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6803' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6804' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6805' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6810' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6882' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:6884' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7213' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7576' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/errata/RHSA-2023:7578' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://access.redhat.com/security/cve/CVE-2023-46847' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245916' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20231130-0002/' label: af854a3a-2127-422b-91ae-364da2661108 tags: - nvd epss: 0.88351 epssPercentile: 0.99767 ingestedAt: '2026-08-07T03:08:52.414Z' --- ## Overview Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. ## Affected - `squid >= 3.2.0.1, < 6.4` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux_eus = 8.6` - `enterprise_linux_eus = 8.8` - `enterprise_linux_eus = 9.0` - `enterprise_linux_eus = 9.2` - `enterprise_linux_for_arm_64 = 8.0_aarch64` - `enterprise_linux_for_ibm_z_systems = 8.0_s390x` - `enterprise_linux_for_power_little_endian = 8.0_ppc64le` - `enterprise_linux_server = 7.0` - `enterprise_linux_server_aus = 8.2` - `enterprise_linux_server_aus = 8.4` - `enterprise_linux_server_aus = 8.6` - `enterprise_linux_server_aus = 9.2` - `enterprise_linux_server_tus = 8.2` - `enterprise_linux_server_tus = 8.4` - `enterprise_linux_server_tus = 8.6` - `enterprise_linux_server_tus = 8.8` - `enterprise_linux_server_tus = 9.2` - `enterprise_linux_workstation = 7.0` ## Remediation Upgrade past the affected range: - `squid 6.4`