VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 6, 2023· Updated Nov 3, 2025

SQUID-2021:8 Denial of Service in Gopher gateway

CVE-2023-46728

Description

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

22

Patches

Vulnerability mechanics

Root cause

"NULL pointer dereference in Squid's Gopher gateway code causes a denial of service."

Attack vector

An attacker can trigger a NULL pointer dereference by sending a crafted Gopher request to a vulnerable Squid proxy. The gopher protocol is always enabled by default in affected versions. Responses causing this bug can originate from any gopher server, even benign ones, making the attack trivially exploitable without special privileges.

Affected code

The commit removes all Gopher protocol support from Squid, including documentation references and translation strings. The vulnerability resides in Squid's Gopher gateway code, which is present in all versions prior to 6.0.1.

What the fix does

The patch removes all Gopher protocol support from Squid entirely, eliminating the vulnerable code path. By deleting the Gopher gateway implementation, the NULL pointer dereference bug can no longer be reached. Users unable to upgrade are advised to reject all gopher URL requests as a workaround.

Preconditions

  • configSquid must have the gopher protocol enabled (default in versions prior to 6.0.1)
  • networkAttacker must be able to send a request to the Squid proxy that triggers the Gopher gateway

Generated on Jun 13, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.