CVE-2025-62168: Squid is a caching proxy for the Web

Q: How do I fix CVE-2025-62168?

squid: upgrade to 7.2. Exact commands for each OS are on this page.

Q: Is CVE-2025-62168 being exploited?

CVE-2025-62168 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2025-62168 affect?

CVE-2025-62168 affects squid. Severity is critical (CVSS 10.0). Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protecti

Q: How urgent is CVE-2025-62168?

Priority 73/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

This week

CRITICAL 10.0REMOTEUPGRADE

CVE-2025-62168 is a critical-severity flaw (CVSS 10.0) affecting squid. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backe

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	10.0 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	63.4% (top 1%)
CISA exploited list	No
Weakness	CWE-209, CWE-550
Published	2025-10-17
Last modified	2026-10-19

Publisher (CNA): GitHub, Inc. · Vendor: squid-cache

Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2025-10-17 17:15 UTCPublished CVE record published
2026-10-19 16:10 UTCUpdated Record last modified

squid-cache squid UPGRADE

Affected: < 7.2

Fixed in: 7.2

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy squid || rpm -q squid || squid --version

2. UPGRADE to 7.2 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade squid

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade squid

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora 46 · php-pecl-yac · FIXED · 3.0.2-1.fc46 · FEDORA-2026-0322a78385 · source

sudo dnf upgrade --advisory=FEDORA-2026-0322a78385

Fedora ELN · openldap · FIXED · 2.6.16-1.eln159 · FEDORA-2026-4b30c86326 · source

sudo dnf upgrade --advisory=FEDORA-2026-4b30c86326

Ubuntu 20.04 · squid · FIXED · 4.10-1ubuntu1.13+esm1

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "4.10-1ubuntu1.13+esm1" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 22.04 · squid · FIXED · 5.9-0ubuntu0.22.04.4

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "5.9-0ubuntu0.22.04.4" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 24.04 · squid · FIXED · 6.13-0ubuntu0.24.04.3

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "6.13-0ubuntu0.24.04.3" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.04 · squid · FIXED · 6.13-1ubuntu1.2

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "6.13-1ubuntu1.2" && echo PATCHED || echo STILL-VULNERABLE

Ubuntu 25.10 · squid · FIXED · 6.13-1ubuntu4.1

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "6.13-1ubuntu4.1" && echo PATCHED || echo STILL-VULNERABLE

Debian 12 · squid · FIXED · 5.7-2+deb12u4

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "5.7-2+deb12u4" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · squid · FIXED · 6.13-2+deb13u1

sudo apt update && sudo apt install --only-upgrade squid dpkg --compare-versions "$(dpkg-query -W -f='${Version}' squid)" ge "6.13-2+deb13u1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 10 · squid · FIXED · squid-6.10-6.el10_1.1

sudo dnf upgrade --advisory=RHSA-2025:21002 rpm -q squid

RHEL 10.0 Extended Update Support · squid · FIXED · squid-6.10-5.el10_0.1

sudo dnf upgrade --advisory=RHSA-2025:21065 rpm -q squid

RHEL 7 Extended Lifecycle Support · squid · FIXED · squid-3.5.20-17.el7_9.15

sudo dnf upgrade --advisory=RHSA-2025:19167 rpm -q squid

RHEL 9 · squid · FIXED · squid-5.5-22.el9_7.1

sudo dnf upgrade --advisory=RHSA-2025:20935 rpm -q squid

RHEL 9.0 Update Services for SAP Solutions · squid · FIXED · squid-5.2-1.el9_0.9

sudo dnf upgrade --advisory=RHSA-2025:19118 rpm -q squid

Alpine 3.23 · squid · FIXED · squid-7.3-r0

apk add --upgrade squid apk info -v squid

Alpine 3.24 · squid · FIXED · squid-7.3-r0

apk add --upgrade squid apk info -v squid

Amazon Linux 2023 · see advisory · FIXED · ALAS2023-2025-1238 · source

sudo dnf update --advisory=ALAS2023-2025-1238

Amazon Linux 2 · see advisory · FIXED · ALAS2-2025-3045 · source

sudo yum update --advisory=ALAS2-2025-3045

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: monzaviman/CVE-2025-62168 (16 stars)
GitHub PoC: shahroodcert/CVE-2025-62168 (1 stars)
GitHub PoC: nehkark/CVE-2025-62168 (0 stars)
Nuclei scan template: Squid Proxy - HTTP Authentication Credentials Disclosure

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2025-62168?

squid: upgrade to 7.2. Exact commands for each OS are on this page.

Is CVE-2025-62168 being exploited?

CVE-2025-62168 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2025-62168 affect?

CVE-2025-62168 affects squid. Severity is critical (CVSS 10.0). Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protecti

How urgent is CVE-2025-62168?

Priority 73/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Software pages

Squid vulnerabilities

Related CVEs

CVE-2026-47729 MEDIUM 6.5 UPGRADE Squid is a caching proxy for the Web
CVE-2026-50012 MEDIUM 5.5 UPGRADE Squid is a caching proxy for the Web
CVE-2026-33526 HIGH 7.5 UPGRADE Squid is a caching proxy for the Web
CVE-2026-32748 HIGH 7.5 UPGRADE Squid is a caching proxy for the Web
CVE-2026-33515 MEDIUM 6.5 UPGRADE Squid is a caching proxy for the Web

References

← Back to latest CVEs