Skip to content
Fencer Vulns
critical 10.0

CVE-2025-62168 in the critical feed json

Squid vulnerable to information disclosure via authentication credential leakage in error handling

published 2025-10-17 12 mo ago modified 2026-10-19 21 d ago also EUVD-2025-34894

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
64.8%
EPSS 64.8% chance of exploitation in 30 days, percentile 99.2%
public exploits
0
none known, plus a Nuclei check

Summary

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.

Patch / fix

  • squid-cache squid 7.2
  • squid Debian 12 5.7-2+deb12u4
  • squid Debian 13 6.13-2+deb13u1
  • squid Debian 14 7.2-1

debian advisories DEBIAN-CVE-2025-62168

  • squid Ubuntu 22.04 LTS 5.9-0ubuntu0.22.04.4
  • squid Ubuntu 24.04 LTS 6.13-0ubuntu0.24.04.3
  • squid Ubuntu 25.10 6.13-1ubuntu4.1
  • squid Ubuntu Pro 20.04 LTS 4.10-1ubuntu1.13+esm1
  • squid3 Ubuntu Pro 16.04 LTS 3.5.12-1ubuntu7.16+esm5
  • squid3 Ubuntu Pro 18.04 LTS 3.5.27-1ubuntu1.14+esm4

ubuntu advisories UBUNTU-CVE-2025-62168

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • squid RHEL 10.1 7:6.10-6.el10_1.1
  • squid RHEL 9 7:5.5-22.el9_7.1
  • squid RHEL 8 7:4.15-10.module+el8.10.0+23592+d564ec65.9
  • libecap RHEL 8 1.0.1-2.module+el8.9.0+19703+a1da7223
  • squid RHEL 8.4 EUS_LONG_LIFE, RHEL 8.4 AUS 7:4.11-4.module+el8.4.0+23593+1fc48abe.10
  • libecap RHEL 8.8 TUS, RHEL 8.8 E4S, RHEL 8.6 TUS +5 more 1.0.1-2.module+el8.1.0+4044+36416a77
  • squid RHEL 9.6 EUS 7:5.5-19.el9_6.2
  • squid enterprise linux eus 10.0 7:6.10-5.el10_0.1

red hat advisories RHSA-2025:21090RHSA-2025:21066RHSA-2025:21065RHSA-2025:21002RHSA-2025:20935RHSA-2025:19967

  • squid SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +5 more 5.7-150400.3.41.1
  • squid SLES for SAP applications 16.0, SLES 16.0 6.12-160000.3.1
  • squid SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 4.17-150000.5.58.1
  • squid SLE Module for Server Applications 15 SP7, SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 6.10-150600.3.14.1
  • squid SLES for SAP 15 SP5, SLES for SAP 15 SP4, SLES 15 SP5-LTSS +7 more 5.7-150400.3.38.2
  • squid SLES LTSS Extended Security 12 SP5, SLES 12 SP5-LTSS 4.17-4.59.1

suse advisories SUSE-SU-2026:4909-1SUSE-SU-2026:20078-1SUSE-SU-2025:4099-1SUSE-SU-2025:4029-1SUSE-SU-2025:4026-1SUSE-SU-2025:3902-1

  • squid openSUSE Leap 16.0 6.12-160000.3.1
  • squid openSUSE Tumbleweed 7.3-1.1

opensuse advisories openSUSE-SU-2026:20027-1openSUSE-SU-2025:15715-1

  • squid AlmaLinux 9 7:5.5-22.el9_7.1
  • squid AlmaLinux 10 7:6.10-6.el10_1.1
  • squid AlmaLinux 8 7:4.15-10.module_el8.10.0+4055+645078d8.9
  • libecap AlmaLinux 8 1.0.1-2.module_el8.6.0+2741+01592ae8
  • libecap AlmaLinux 8 1.0.1-2.module_el8.6.0+3048+383bc947

almalinux advisories ALSA-2025:20935ALSA-2025:21002ALSA-2025:19107

  • squid Rocky Linux 8 7:4.15-10.module+el8.10.0+2080+49064dbd.9
  • libecap Rocky Linux 8 1.0.1-2.module+el8.9.0+1437+df5ea8f0
  • squid Rocky Linux 10 7:6.10-6.el10_1.1
  • squid Rocky Linux 9 7:5.5-22.el9_7.1

rocky linux advisories RLSA-2025:19107RLSA-2025:21002RLSA-2025:20935

  • squid Alpine 3.24, Alpine 3.23 7.3-r0

alpine advisories ALPINE-CVE-2025-62168

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • squid Azure Linux 3.0 6.13-3

azure linux advisories AZL-68562

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-62168 updated cvss 8.6

squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling

  • Red Hat Enterprise Linux 6 squid, squid34
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux AppStream (v. 8) libecap 1.0.1-2.module+el8.9.0+19703+a1da7223, squid 4.15-10.module+el8.10.0+23592+d564ec65.9
    fixed: vendor fix RHSA-2025:19107
  • Red Hat Enterprise Linux AppStream (v. 9) squid 5.5-22.el9_7.1
    fixed: vendor fix RHSA-2025:20935
  • Red Hat Enterprise Linux AppStream (v. 10) squid 6.10-6.el10_1.1
    fixed: vendor fix RHSA-2025:21002
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.4-8.module+el8.2.0+23601+6cdb820c.11
    fixed: vendor fix RHSA-2025:19967
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.11-4.module+el8.4.0+23593+1fc48abe.10
    fixed: vendor fix RHSA-2025:21090
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-3.module+el8.6.0+23600+226c63ed.8 Red Hat Enterprise Linux AppStream E4S (v.8.6) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-3.module+el8.6.0+23600+226c63ed.8
    fixed: vendor fix RHSA-2025:19277
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-6.module+el8.8.0+23607+473e38b5.8
    fixed: vendor fix RHSA-2025:19398
show 10 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.0) squid 5.2-1.el9_0.9
    fixed: vendor fix RHSA-2025:19118
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) squid 5.5-5.el9_2.10
    fixed: vendor fix RHSA-2025:19114
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) squid 6.10-5.el10_0.1
    fixed: vendor fix RHSA-2025:21065
  • Red Hat Enterprise Linux AppStream EUS (v.9.4) squid 5.5-13.el9_4.4
    fixed: vendor fix RHSA-2025:19115
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) squid 5.5-19.el9_6.2
    fixed: vendor fix RHSA-2025:21066
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.11-4.module+el8.4.0+23593+1fc48abe.10
    fixed: vendor fix RHSA-2025:21090
  • Red Hat Enterprise Linux AppStream TUS (v.8.6) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-3.module+el8.6.0+23600+226c63ed.8
    fixed: vendor fix RHSA-2025:19277
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) libecap 1.0.1-2.module+el8.1.0+4044+36416a77, squid 4.15-6.module+el8.8.0+23607+473e38b5.8
    fixed: vendor fix RHSA-2025:19398
  • Red Hat Enterprise Linux Server (v. 7 ELS) squid 3.5.20-17.el7_9.15
    fixed: vendor fix RHSA-2025:19167
  • Red Hat Enterprise Linux Server (v. 7 ELS) squid 3.5.20-17.el7_9.15, squid-migration-script 3.5.20-17.el7_9.15 Red Hat Enterprise Linux Server Optional (v. 7 ELS) squid-sysvinit 3.5.20-17.el7_9.15
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
12 mo ago

Exploit prediction

64.82% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Squid Proxy - HTTP Authentication Credentials Disclosure nuclei detection template

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • squid-cache squid

Classification

Weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information
  • CWE-550 Server-generated Error Message Containing Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.