Squid vulnerable to information disclosure via authentication credential leakage in error handling

The primary impact of CVE-2025-62168 is the potential for information disclosure of HTTP authentication credentials. An attacker could craft malicious requests that trigger error conditions within Squid, leading to the exposure of these credentials in error messages. This could allow them to identify security tokens or credentials used internally by web applications that utilize Squid as a proxy. While the vulnerability doesn't require Squid to be configured with HTTP authentication, the exposure of credentials used by trusted clients poses a significant risk. The blast radius extends to any backend application relying on Squid for load balancing, as compromised credentials could be leveraged to gain unauthorized access to those systems. This vulnerability shares similarities with other information disclosure flaws where error handling mechanisms fail to sanitize sensitive data.

1. 已保留2025-10-07
2. 发布日期2025-10-17
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-62168 is to upgrade Squid to version 7.2 or later, which contains the fix. If immediate upgrading is not feasible, consider implementing temporary workarounds. Review Squid's error logging configuration to ensure sensitive information is not being logged. Implement Web Application Firewall (WAF) rules to filter out potentially malicious requests that could trigger error conditions. Monitor Squid logs for unusual activity or patterns that might indicate exploitation attempts. After upgrading, confirm the fix by sending a request designed to trigger the error handling and verifying that credentials are not exposed in the response.