CVE-2023-5824: Squid: dos against http and https

CVE-2023-5824 is a vulnerability in Squid: dos against http and https, rated Important by Microsoft, with a CVSS 3.1 base score of 7.5 (High). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 3.28% probability of exploitation activity in the next 30 days, higher than 88% of all scored vulnerabilities. Microsoft released the fix on 3 September 2025 in the November 2023 Patch Tuesday. It affects 1 product in 1 product family (Other).

Key facts

CVE ID: CVE-2023-5824
Severity: High CVSS 7.5
Microsoft severity: Important
Exploited in the wild: No
Publicly disclosed: No
Weakness: CWE-755
EPSS: 3.28% (percentile 88%)
CISA KEV: Not listed
Released: 3 September 2025
Last updated: 12 August 2026
Patch Tuesday: November 2023 Patch Tuesday
Product families: Other

CVSS score and vector

Microsoft scores CVE-2023-5824 at 7.5 (temporal 7.5) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Metric	Value
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality impact	None
Integrity impact	None
Availability impact	High

Frequently asked questions (Microsoft)

Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?

One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.

Affected products (1)

Other

Product	Security update	Type	Fixed build	Restart
20164-17084	CBL-Mariner Releases	Security Update	6.5-1	No

NIST NVD data

NVD status: Modified
NVD CVSS: 7.5 (HIGH)
NVD weakness: CWE-755
Published to NVD: 3 November 2023
NVD last modified: 17 June 2026

Affected configurations (CPE)

Product	Vulnerable versions
squid	before 6.4
enterprise linux 6.0	all listed versions
enterprise linux 7.0	all listed versions
enterprise linux 8.0	all listed versions
enterprise linux 9.0	all listed versions

References

Revision history

Version	Date	Description
1.0	3 September 2025	Information published.
1.1	21 February 2026	Information published.
2.0	12 August 2026	Information published.