CVE-2025-54574 is a critical (CVSS 9.3) heap buffer overflow in the Squid caching proxy, triggered by processing URNs. It could allow remote code execution. Versions 6.3 and below are affected; Squid 6.4 fixes it, and disabling URN access is the workaround.
What's affected
- Squid 6.3 and below is affected, per the record.
- Fixed in Squid 6.4.
- Workaround from the advisory: disable URN access permissions.
- Debian published an LTS announcement, so distribution packages may carry a backported fix.
The record lists CVSS 9.3 (Critical). It is not on the CISA Known Exploited Vulnerabilities list as of the record.
How to check if you're exposed
Check the version.
squid -v
Then search your configuration for URN access rules.
grep -n "urn" /etc/squid/squid.conf
On Debian or Ubuntu, read the package changelog for the backport.
What to do now
- Upgrade to Squid 6.4 or later, or install your distribution's security update.
- If you cannot upgrade yet, deny URN access in your access rules as the advisory suggests.
- Do not expose the proxy to untrusted clients.
- Rebuild container images that embed Squid.
- Restart the service and confirm the new version.
- Run the free in browser dependency scan to find affected components across your projects, then check the Gold entry for updates.
Work in that order. Inventory first, because you cannot patch what you do not know you run. Fix the internet facing and shared systems before the internal ones, and write down the version you ended up on so the next review starts from facts rather than memory.
Why it matters
The weaknesses are CWE-122, heap based buffer overflow, and CWE-787, out of bounds write. The record names incorrect buffer management as the cause. A write past the end of a heap buffer can corrupt memory, and in a network daemon that can mean code execution.
A forward proxy sits where many clients meet the internet, which makes it a useful foothold. The record does not flag KEV status, and the advisory text in the record does not describe exploitation.
Severity scores are a starting point. The score for this entry is 9.3, and it describes the worst case for the weakness, not your environment. Weigh it against whether the affected component is reachable from outside, who can talk to it, and what it can touch if it is taken over. Reachability analysis helps with that last question for libraries, and the Gold page for this CVE collects the affected versions in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I just turn off URN access?
The advisory names that as a workaround. Upgrading is the real fix.
Does my Linux distribution carry the fix?
Check its security tracker or package changelog, since fixes are often backported.
Sources
- https://github.com/squid-cache/squid/commit/a27bf4b84da23594150c7a86a23435df0b35b988
- https://github.com/squid-cache/squid/releases/tag/SQUID_6_4
- https://github.com/squid-cache/squid/security/advisories/GHSA-w4gv-vw3f-29g3
- http://www.openwall.com/lists/oss-security/2025/11/05/5
- https://lists.debian.org/debian-lts-announce/2025/09/msg00027.html
Last reviewed: 18 October 2026.
