CVE-2025-54574

CRITICAL

Squid < 6.4 - Heap-based Buffer Overflow via URN Processing

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2025-54574. PoCs published by starrynightsecurity, gmh5225.

AI-analyzed exploit summary This repository documents CVE-2025-54574, a critical heap-based buffer overflow in Squid Proxy (<6.4) triggered during URN Trivial-HTTP response handling. It includes technical analysis, safe reproduction steps, and sanitized logs, but no functional exploit code.

Description

Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions.

Exploits (2)

nomisec WRITEUP
by starrynightsecurity · poc
https://github.com/starrynightsecurity/CVE-2025-54574-Squid-Heap-Buffer-Overflow

This repository documents CVE-2025-54574, a critical heap-based buffer overflow in Squid Proxy (<6.4) triggered during URN Trivial-HTTP response handling. It includes technical analysis, safe reproduction steps, and sanitized logs, but no functional exploit code.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Squid Proxy <6.4
No auth needed
Prerequisites: Attacker-controlled server · Squid Proxy <6.4
devstral-2 · analyzed Feb 19, 2026 Full analysis →
nomisec WRITEUP
by gmh5225 · poc
https://github.com/gmh5225/Blackash-CVE-2025-54574

The repository provides a detailed technical analysis of CVE-2025-54574, a heap-based buffer overflow in Squid Proxy versions ≤ 6.3, along with a mitigation script to disable URN access. It includes a comprehensive breakdown of the vulnerability, risk metrics, and remediation steps.

Classification
Writeup 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Theoretical
Target: Squid Proxy (versions 6.3 and earlier)
No auth needed
Prerequisites: Network access to the Squid Proxy server · Squid Proxy version ≤ 6.3
devstral-2 · analyzed Feb 19, 2026 Full analysis →

References (5)

Core 5

Scores

CVSS v3 9.3
EPSS 0.2346
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-122 CWE-787
Status published
Products (1)
squid-cache/squid < 6.4
Published Aug 01, 2025
Tracked Since Feb 18, 2026