VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 1, 2023· Updated Feb 13, 2025

SQUID-2023:4 Denial of Service in SSL Certificate validation

CVE-2023-46724

Description

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using --with-openssl are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

23

Patches

Vulnerability mechanics

Root cause

"Improper validation of the Common Name (CN) in SSL certificates allows for a denial of service."

Attack vector

A remote server can initiate a TLS handshake with a specially crafted SSL certificate chain against a vulnerable Squid proxy. This attack is limited to HTTPS and SSL-Bump configurations. The crafted certificate causes an improper validation of the certificate's Common Name (CN), leading to a denial of service. [ref_id=1]

Affected code

The vulnerability resides in the `matchDomainName` function within the `src/anyp/Uri.cc` file. The patch specifically adds checks for an empty domain string (`dl == 0`) to prevent improper handling during certificate validation. [ref_id=1]

What the fix does

The patch modifies the `matchDomainName` function to correctly handle cases where the domain string is empty. Previously, an empty domain string could lead to incorrect comparisons and potential buffer under-reads when validating certificate Common Names. The fix ensures that such cases are handled properly, preventing the denial of service vulnerability. [ref_id=1]

Preconditions

  • configSquid must be compiled with `--with-ssl`.
  • configThe Squid proxy must be configured to handle HTTPS or SSL-Bump traffic.

Generated on Jun 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.