CVE-2025-62168
HighIn Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure.
Published Oct 17, 2025 · Updated Aug 12, 2026 · Also known as ALPINE-CVE-2025-62168, DEBIAN-CVE-2025-62168, DSA-6047-1, GHSA-c8cc-phh7-xmxr, UBUNTU-CVE-2025-62168, USN-7845-1
Key Facts
Patch immediately- CVE-2025-62168 is a high-severity vulnerability (CVSS 7.5 v3.1) affecting Squid (Squid-Cache), squid3 (ubuntu), squid-cgi (ubuntu) and 9 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 63% probability of exploitation in the next 30 days.
- Fixed versions are available, including libecap 1.0.1-2.module_el8.6.0+2741+01592ae8, libecap 1.0.1-2.module+el8.9.0+1437+df5ea8f0, libecap 1.0.1-2.module+el8.9.0+90083+f7556140.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS (30-day exploit likelihood)
63%
Higher than 99.2% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2025-62168 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing. These attacks do not require Squid to be configured with HTTP authentication. The vulnerability is fixed in version 7.2. As a workaround, disable debug information in administrator mailto links generated by Squid by configuring squid.conf with email_err_data off.
Affected Products
127 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SquidSquid-Cache | >= < 7.2 | 7.2 |
| squid3ubuntu | See advisory | 3.5.12-1ubuntu7.16+esm5 |
| squid-cgiubuntu | See advisory | 3.5.27-1ubuntu1.14+esm4 |
| squidclientubuntu | See advisory | 3.5.27-1ubuntu1.14+esm4 |
| squid-commonubuntu | See advisory | 3.5.27-1ubuntu1.14+esm4 |
Patched Releases
libecap
1.0.1-2.module_el8.6.0+2741+01592ae8, 1.0.1-2.module+el8.9.0+1437+df5ea8f0, 1.0.1-2.module+el8.9.0+90083+f7556140
libecap-devel
1.0.1-2.module+el8.9.0+90083+f7556140
Squid
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4, 4.10-1ubuntu1.13+esm1, 4.13-10+deb11u6, 4.17-150000.5.58.1, 4.17-4.59.1, 5.7-150400.3.38.2, 5.7-2+deb12u4, 5.9-0ubuntu0.22.04.4, 6.10-150600.3.14.1, 6.12-160000.3.1, 6.12-5.ph5, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1, 6.13-2+deb13u1, 6.13-3, 6.6-7.ph4, 7:3.5.20-17.0.9.el7_9.13, 7:3.5.20-17.amzn2.7.25, 7:3.5.20-17.el7_9.15, 7:4.15-10.module_el8.10.0+4055+645078d8.9, 7:4.15-10.module+el8.10.0+2080+49064dbd.9, 7:4.15-10.module+el8.10.0+90691+00cd6d19.9, 7:5.5-22.el9_7.1, 7:5.5-5.el9_2.10, 7:6.10-5.el10_0.1, 7:6.10-6.el10_1.1, 7:6.13-1.amzn2023.0.3, 7.2-1, 7.3-1.1, 7.3-r0, 7.6-r0, 7.2
squid-cgi
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4, 4.10-1ubuntu1.13+esm1, 5.9-0ubuntu0.22.04.4, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1
squid-common
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4, 4.10-1ubuntu1.13+esm1, 5.9-0ubuntu0.22.04.4, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1
squid-migration-script
7:3.5.20-17.0.9.el7_9.13, 7:3.5.20-17.amzn2.7.25
squid-openssl
5.9-0ubuntu0.22.04.4, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1
squid-purge
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4, 4.10-1ubuntu1.13+esm1, 5.9-0ubuntu0.22.04.4, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1
squid-sysvinit
7:3.5.20-17.0.9.el7_9.13, 7:3.5.20-17.amzn2.7.25
squid:4
8060020251027230224.ad008a3a
squid3
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4
squidclient
3.5.12-1ubuntu7.16+esm5, 3.5.27-1ubuntu1.14+esm4, 4.10-1ubuntu1.13+esm1, 5.9-0ubuntu0.22.04.4, 6.13-0ubuntu0.24.04.3, 6.13-1ubuntu1.2, 6.13-1ubuntu4.1
Timeline
Publicly disclosed
Oct 17, 2025
Last updated
Aug 12, 2026
Weakness Type
- CWE-209 Generation of Error Message Containing Sensitive Information
- CWE-550 Server-generated Error Message Containing Sensitive Information
References
- advisoryRHSA-2025:19107
- advisoryRHSA-2025:19114
- advisoryRHSA-2025:19115
- advisoryRHSA-2025:19118
- advisoryRHSA-2025:19167
FAQ
Common Questions.
Squid is a caching proxy for the Web.
Affected: Squid (Squid-Cache) versions >= < 7.2; squid3 (ubuntu); squid-cgi (ubuntu), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including libecap 1.0.1-2.module_el8.6.0+2741+01592ae8, libecap 1.0.1-2.module+el8.9.0+1437+df5ea8f0, libecap 1.0.1-2.module+el8.9.0+90083+f7556140.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2025-62168 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo