Squid: multiple flaws including HTTP request smuggling (CVE-2023-46846) warned about by BSI CERT-Bund
CVE-2023-46846 CVE-2023-46847 CVE-2023-46848 CVE-2023-49285 CVE-2023-49286 CVE-2023-49288 CVE-2023-5824
Published 03/11/2026 02:18
Timeline
2 events over 6 d 13 h
- 27/10/2026 13:16ConfirmedBSI CERT-Bund (WID)+6 d 13 h
- 03/11/2026 02:18Published on WatchtowerPro CISO
In short
Squid has several vulnerabilities, including HTTP request smuggling in chunked decoding (CVE-2023-46846). BSI CERT-Bund warns that a remote, anonymous attacker could use them for denial of service, information disclosure or to bypass security measures. Fixed versions are not yet confirmed here. Shodan estimates 1.7 million internet-facing systems tagged with CVE-2023-46846 worldwide, 129,015 of them in the EU (03/11/2026).
How bad is it
High to critical: a remote attacker who can reach a vulnerable Squid proxy, without logging in, may bypass security measures, disclose information or cause denial of service.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 7 CVEs · CVSS 3.1 from NVD, read 03/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Take it offline
Type: information disclosure.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Squid, through CVE-2023-46846: Red Hat says the attack is limited to HTTP/1.1 and ICAP, because those protocols accept Transfer-Encoding: chunked.
What to do now
- Find where Squid runs in your environment, including distribution packages, and note whether it accepts HTTP/1.1 or ICAP traffic.
- Check the vendor advisory (Squid GHSA-j83v-w3p4-5cqh) and your distribution's security notices for fixed versions, and update when they are confirmed. Exact fixed versions are not yet known from the sources.
- No vendor interim measures are known yet. Any interim measure only reduces exposure and does not make a server safe.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 6 sources with their dates. And technology matching: which of your systems run Squid, at which version, fixed or not - and what each one needs.
Main sources
[UPDATE] [hoch] Squid: Mehrere Schwachstellen ermöglichen Denial of Service CERT · [UPDATE] [hoch] Squid: Mehrere Schwachstellen CERT · [UPDATE] [kritisch] Squid: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen und Offenlegung von Informationen CERT