---
id: CVE-2023-5824
title: 'Squid: dos against http and https'
summary: >-
  A flaw was found in Squid. The limits applied for validation of HTTP response
  headers are applied before caching. However, Squid may grow a cached HTTP
  response header beyond the configured maximum size, causing a stall or crash
  of the w…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-755
vendor: Red Hat
product: 'squid:4'
affected:
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - 'squid:4 (all versions)'
  - squid (all versions)
  - squid (all versions)
  - squid (all versions)
  - squid (all versions)
  - squid (all versions)
published: '2023-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T21:06:17.325Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-5824'
references:
  - url: 'https://access.redhat.com/errata/RHSA-2023:7465'
    label: 'RHSA-2023:7465'
  - url: 'https://access.redhat.com/errata/RHSA-2023:7668'
    label: 'RHSA-2023:7668'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0072'
    label: 'RHSA-2024:0072'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0397'
    label: 'RHSA-2024:0397'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0771'
    label: 'RHSA-2024:0771'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0772'
    label: 'RHSA-2024:0772'
  - url: 'https://access.redhat.com/errata/RHSA-2024:0773'
    label: 'RHSA-2024:0773'
  - url: 'https://access.redhat.com/errata/RHSA-2024:1153'
    label: 'RHSA-2024:1153'
  - url: 'https://access.redhat.com/security/cve/CVE-2023-5824'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2245914'
    label: RHBZ#2245914
  - url: >-
      https://github.com/squid-cache/squid/security/advisories/GHSA-543m-w2m2-g255
tags:
  - cve.org
epss: 0.03284
epssPercentile: 0.88498
ingestedAt: '2026-11-05T21:36:00.592Z'
---

## Overview

A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service.

## Affected

- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid:4 (all versions)`
- `squid (all versions)`
- `squid (all versions)`
- `squid (all versions)`
- `squid (all versions)`
- `squid (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Disabling the disk caching mechanism will mitigate this vulnerability. To achieve this, remove all the 'cache_dir' directives from the Squid configuration, typically in the /etc/squid/squid.conf file.