Is CVE-2023-46724 actively exploited?

CVE-2023-46724 has no public evidence of in-the-wild exploitation as of 2025-02-13.

What is the CVSS score for CVE-2023-46724?

CVE-2023-46724 has a CVSS score of 8.6 (HIGH severity). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.

How do I patch CVE-2023-46724?

Patch guidance is available from squid-cache security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2023-46724.

Fix CVE-2023-46724 - HIGH squid-cache squid

Description

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector: network
Complexity: low
Privileges: none
User Action: none
Scope: changed
Confidentiality: none
Integrity: none
Availability: high
Weaknesses: CWE-125 · Out-of-bounds Read CWE-129 CWE-786 CWE-823 CWE-1285 CWE-295

Metadata

Primary Vendor: SQUID-CACHE
Published: 11/1/2023
Last Modified: 2/13/2025
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

squid-cache : squid

Remediation Guidance

Executive Summary

Cite this page

CVE-2023-46724. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2023-46724

View on NIST NVD

CVE-2023-46724 vulnerability