cbcvebase.
CVE-2007-0248
published 2007-01-16

CVE-2007-0248: The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue…

PriorityP421medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
6.69%
93.2th percentile
The aclMatchExternal function in Squid before 2.6.STABLE7 allows remote attackers to cause a denial of service (crash) by causing an external_acl queue overload, which triggers an infinite loop.

Affected

6 ranges
VendorProductVersion rangeFixed in
debiansquid< squid 2.6.5-4 (bookworm)squid 2.6.5-4 (bookworm)
squidsquid
squidsquid>= 0 < 2.6.5-42.6.5-4
squidsquid>= 0 < 2.6.5-42.6.5-4
squidsquid>= 0 < 2.6.5-42.6.5-4
squidsquid>= 0 < 2.6.5-42.6.5-4

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerable function is `aclMatchExternal` in Squid; triggering an external_acl queue overload causes an infinite loop (CPU starvation/crash). Monitor for sustained CPU spikes in the Squid process coinciding with external ACL helper exhaustion.
  • This vulnerability is only exploitable when external ACL helpers are configured and in use. Deployments without `external_acl_type` directives in squid.conf are not affected.
  • The attack vector is remote: any user with access to the Squid proxy can trigger the condition by exhausting the external ACL helper queue. Restrict proxy access to trusted clients as a compensating control.
  • ·Only Squid versions before 2.6.STABLE7 are vulnerable. Squid 2.6.STABLE7 and later contain the fix.
  • ·Red Hat Enterprise Linux 2.1, 3, 4, and 5 are not affected — RHEL 5 carries a backported patch and earlier versions were never vulnerable.
  • ·Debian resolved this in package version 2.6.5-4 across all active suites (bookworm, bullseye, forky, sid, trixie).

CVSS provenance

nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.