A heap‑based buffer overflow in the cache_digest reply handling of Squid can be triggered by a trusted server that sends specially crafted replies. The flaw stems from improper input validation when processing cache digest messages. Exploitation results in a denial of service, terminating or crashing the Squid process for the victim server.

The vulnerability affects the Squid caching proxy server. No specific Squid version numbers are listed, so any installation running an unpatched version of Squid that processes cache_digest replies is potentially exposed.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available and the issue is not in CISA KEV, suggesting limited evidence of exploitation in the wild. The attacker must be a trusted server within the network, able to send crafted cache_digest replies to the vulnerable Squid instance. Successful exploitation would be internal or hybrid, causing a service disruption of the proxy.