Skip to content
Fencer Vulns
critical 9.3

CVE-2023-46846 json

Squid: request/response smuggling in http/1.1 and icap

published 2023-11-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-51012

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
7.2%
EPSS 7.2% chance of exploitation in 30 days, percentile 94%
public exploits
0
none known

Summary

SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 7:3.5.20-17.el7_9.13
  • Red Hat Red Hat Enterprise Linux 8 8080020231030214932.63b34585, 8090020231030224841.a75119d5
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions 8010020231101141358.c27ad7f8
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support 8020020231101135052.4cda2c84
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service 8020020231101135052.4cda2c84
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions 8020020231101135052.4cda2c84
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020231101101624.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service 8040020231101101624.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions 8040020231101101624.522a0ee4
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support 8060020231031165747.ad008a3a
  • Red Hat Red Hat Enterprise Linux 9 7:5.5-5.el9_2.1, 7:5.5-6.el9_3.1
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support 7:5.2-1.el9_0.3
  • squid Debian 12 5.7-2+deb12u1
  • squid Debian 14, Debian 13 6.5-1

debian advisories DEBIAN-CVE-2023-46846

  • squid Ubuntu 20.04 LTS 4.10-1ubuntu1.8
  • squid Ubuntu 22.04 LTS 5.7-0ubuntu0.22.04.2
  • squid Ubuntu 24.04 LTS 6.1-2ubuntu2

ubuntu advisories UBUNTU-CVE-2023-46846

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libecap RHEL 8, RHEL 8.6 EUS, RHEL 8.4 TUS +6 more 1.0.1-2.module+el8.1.0+4044+36416a77
  • squid RHEL 9 7:5.5-6.el9_3.1
  • squid RHEL 8 7:4.15-7.module+el8.9.0+20571+8d39338b.1
  • libecap RHEL 8 1.0.1-2.module+el8.9.0+19703+a1da7223
  • squid RHEL 8 7:4.15-6.module+el8.8.0+20569+26050b0f.1
  • squid RHEL 9 7:5.5-5.el9_2.1
  • squid RHEL 7 ELS 7:3.5.20-17.el7_9.13
  • squid-sysvinit RHEL 7 ELS 7:3.5.20-17.el7_9.13

red hat advisories RHSA-2024:11049RHSA-2023:6810RHSA-2023:6804RHSA-2023:6803RHSA-2023:6801RHSA-2023:6748

  • squid SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES for SAP 15 SP1 +8 more 4.17-150000.5.38.1
  • squid SLES for SAP 12 SP5, SLES 12 SP5 4.17-4.30.1
  • squid SLE Module for Server Applications 15 SP5, SLE Module for Server Applications 15 SP4, openSUSE Leap 15.5 +1 more 5.7-150400.3.12.1

suse advisories SUSE-SU-2023:4384-1SUSE-SU-2023:4381-1SUSE-SU-2023:4380-1

  • squid openSUSE Tumbleweed 6.4-1.1

opensuse advisories openSUSE-SU-2024:13398-1

  • squid AlmaLinux 8 7:4.15-7.module_el8.9.0+3680+f9142978.1.alma.1
  • libecap AlmaLinux 8 1.0.1-2.module_el8.6.0+2741+01592ae8
  • libecap AlmaLinux 8 1.0.1-2.module_el8.6.0+3048+383bc947
  • squid AlmaLinux 9 7:5.5-6.el9_3.1
  • squid AlmaLinux 9 7:5.5-5.el9_2.1
  • squid AlmaLinux 8 7:4.15-6.module_el8.8.0+3670+56cb3c8e.1.alma.1

almalinux advisories ALSA-2023:7213ALSA-2023:6748ALSA-2023:6266ALSA-2023:6267

  • squid Rocky Linux 8 7:4.15-7.module+el8.9.0+1568+6d4fd5d4.1
  • libecap Rocky Linux 8 1.0.1-2.module+el8.9.0+1437+df5ea8f0
  • squid Rocky Linux 9 7:5.5-5.el9_2.1
  • squid Rocky Linux 8 7:4.15-6.module+el8.8.0+1273+55f5b063
  • libecap Rocky Linux 8 1.0.1-2.module+el8.4.0+404+316a0dc5

rocky linux advisories RLSA-2023:7213RLSA-2023:6266RLSA-2023:6267

  • squid Alpine 3.24, Alpine 3.23, Alpine 3.22 +3 more 6.4-r0

alpine advisories ALPINE-CVE-2023-46846

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • squid Azure Linux 3.0 6.4-1

azure linux advisories AZL-110522

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-46846 updated cvss 9.3

squid: Request/Response smuggling in HTTP/1.1 and ICAP

  • Red Hat Enterprise Linux 6 squid, squid34
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux AppStream (v. 8) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-6.module+el8.8.0+20569+26050b0f.1, squid 4.15-7.module+el8.9.0+20571+8d39338b.1, libecap 1.0.1-2.module+el8.9.0+19703+a1da7223
    fixed: vendor fix RHSA-2023:6267
  • Red Hat Enterprise Linux AppStream (v. 9) squid 5.5-5.el9_2.1, squid 5.5-6.el9_3.1
    fixed: vendor fix RHSA-2023:6266
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) squid 4.4-8.module+el8.2.0+20588+7f9884cb.6, libecap 1.0.1-2.module+el8.1.0+4044+36416a77
    fixed: vendor fix RHSA-2023:6803
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.11-4.module+el8.4.0+20587+c1238193.5
    fixed: vendor fix RHSA-2023:6804
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) squid 4.4-8.module+el8.1.0+20589+bb91f53c.6, libecap 1.0.1-2.module+el8.1.0+4044+36416a77
    fixed: vendor fix RHSA-2023:6810
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) squid 4.4-8.module+el8.2.0+20588+7f9884cb.6, libecap 1.0.1-2.module+el8.1.0+4044+36416a77
    fixed: vendor fix RHSA-2023:6803
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.11-4.module+el8.4.0+20587+c1238193.5
    fixed: vendor fix RHSA-2023:6804
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-3.module+el8.6.0+20581+c33b42aa.3
    fixed: vendor fix RHSA-2023:6801
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) squid 5.2-1.el9_0.3
    fixed: vendor fix RHSA-2023:6268
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) squid 4.4-8.module+el8.2.0+20588+7f9884cb.6, libecap 1.0.1-2.module+el8.1.0+4044+36416a77
    fixed: vendor fix RHSA-2023:6803
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.11-4.module+el8.4.0+20587+c1238193.5
    fixed: vendor fix RHSA-2023:6804
  • Red Hat Enterprise Linux Server (v. 7 ELS) squid 3.5.20-17.el7_9.13, squid-sysvinit 3.5.20-17.el7_9.13, squid-migration-script 3.5.20-17.el7_9.13 Red Hat Enterprise Linux Server Optional (v. 7 ELS) squid 3.5.20-17.el7_9.13, squid-sysvinit 3.5.20-17.el7_9.13, squid-migration-script 3.5.20-17.el7_9.13
    fixed: vendor fix RHSA-2024:11049

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

7.16% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.2 Advanced Update Support
  • Red Hat Red Hat Enterprise Linux 8.2 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.