Executive Summary

What if your system leaked sensitive data , not because of hackers breaking in but because of a tiny mistake in memory handling?

That’s exactly the risk posed by a newly discovered vulnerability in Squid, a widely used web proxy server. Tracked as CVE-2025-54574 , this critical flaw stems from a heap memory bug that could allow attackers to steal private data or even run malicious code on your system.

In this report, we’ll break down:

• What’s actually wrong under the hood of Squid
• How attackers can take advantage of this vulnerability
• What kind of real-world damage it can cause , from leaked credentials to full system compromise
• And most importantly, what you should do right now if you’re running Squid in your environment

Whether you’re a network admin, a security enthusiast, or just curious how a simple coding slip can turn into a major breach, this guide will take you under the hood of one of the most dangerous bugs Squid has faced.

Background – What is Squid?

Squid is a powerful, open-source proxy server and web cache that sits between users and the internet. It's commonly used in organizations like schools, offices, and data centers to control, speed up, and monitor internet access.

In simple terms, instead of every user talking to the internet directly, all their requests go through Squid first. It acts as a middleman that fetches content on behalf of users and stores copies of frequently accessed data.

Multiple users in the same local network browse the internet from their computers. They might be loading websites, watching videos, or downloading files. Instead of these requests going directly to the internet, they are first sent to the Squid proxy server sitting inside the organization’s network.

To the outside world (the internet), all user requests appear to come from just one source: the Squid server. This not only saves bandwidth, but also adds a layer of privacy.

What Is the CVE-2025-54574 Vulnerability?

When a user requests a web resource (like a page using a URN), the request first goes to Squid, not directly to the internet. Squid then contacts the appropriate server and receives the response.

Before storing that response in memory, Squid allocates a certain amount of space (a buffer) based on what it expects to receive. For example, it might assume the response will be 10 KB and prepare memory accordingly.

But if the actual response is larger than expected—say 20 KB—Squid doesn’t stop or resize the memory. Instead, it blindly writes all 20 KB into a 10 KB buffer, overflowing into the memory next to it.

This can lead to:

• Accidental leakage of sensitive memory content (like passwords or tokens)
• Or even allow attackers to inject malicious code that Squid might run later

To confirm the severity of this vulnerability, the Squid Project has issued an official advisory titled "SQUID-2025:1 Buffer Overflow in URN Handling" on their GitHub security page. The advisory rates the bug as Critical with a CVSS score of 9.3, emphasizing the risk of heap buffer overflow, memory leaks, and potential remote code execution.

What Could Go Wrong?

Sensitive Information Could Leak

Because of the memory handling issue, Squid may accidentally send out pieces of its own memory to whoever made the request. This leaked memory can include:

• Passwords
• Login cookies
• Authentication tokens
• Internal system data

Things that should never leave the server could end up in the wrong hands.

Hackers Could Take Control of the System

This isn’t just about spying . In more advanced cases, attackers can use the vulnerability to run their own code on the Squid server. That means:

• Installing malware
• Hijacking your proxy
• Using your server to attack others

Once they’re in, they can do just about anything your proxy has permission to do.

One Compromised Proxy = Entire Network at Risk

In many companies, all internet traffic is routed through Squid meaning every website visited, every download, and every API call goes through it.

If someone compromises that proxy:

• They can monitor or modify any request
• Log sensitive activity
• Break security policies silently

It's like your entire organization has a single front door, and someone just got a copy of the key.

Who's Affected by This Vulnerability?

If you’re using Squid on your network whether it’s at a company, school, internet provider, or data center , this vulnerability is something you should take seriously. It doesn’t just affect rare or old versions. In fact, most commonly used versions of Squid are affected by this issue.

According to the official advisory, the following versions of Squid are affected by this vulnerability:

• Squid 4.x — All versions up to 4.17
• Squid 5.x — All versions up to 5.9
• Squid 6.x — All versions up to 6.3
• Versions older than 4.14 haven’t been tested, but are assumed to be vulnerable

However, the issue has been fully fixed in Squid version 6.4. If you’re already running this version, you’re safe.

How to Protect Systems

The best and most reliable way to protect your systems is to upgrade to Squid version 6.4, which includes the official patch for this vulnerability. This update fully resolves the issue and removes the risk of both memory leaks and remote code execution.

If you’re managing Squid in a sensitive environment like a corporate, ISP, or institutional network , this upgrade should be treated as a top priority.

Final Takeaway

CVE-2025-54574 is not just a minor bug - it’s a critical vulnerability that affects many widely used versions of Squid. Left unpatched, it can lead to sensitive data leaks or even allow attackers to run malicious code on your system.

Stay updated, stay secure.