CVE-2023-46846

CWE-444 — HTTP Request Smuggling6 documents6 sources
Severity
5.3MEDIUM
EPSS
9.6%
top 7.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Squid-cache SquidRedhat Enterprise LinuxRedhat Enterprise Linux EUS+5 more
Timeline
PublishedNov 3
Latest updateNov 21

Description

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:NExploitability: 3.9 | Impact: 4.7

Affected Packages2 packages

▶NVDsquid-cache/squid2.6 — 6.4
▶Debiansquid< 4.13-10+deb11u3+3

Also affects: Enterprise Linux 8.0, 9.0, 8.6, 8.8, 9.2, 8.2, 8.4

🔴Vulnerability Details

2
OSV
CVE-2023-46846: SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past↗2023-11-03
▶
CVEList
Squid: request/response smuggling in http/1.1 and icap↗2023-11-03
▶

📋Vendor Advisories

3
Ubuntu
Squid vulnerabilities↗2023-11-21
▶
Red Hat
squid: Request/Response smuggling in HTTP/1.1 and ICAP↗2023-10-19
▶
Debian
CVE-2023-46846: squid - SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenienc...↗2023
▶