CVE record · CVE-2023-46846

Squid: request/response smuggling in http/1.1 and icap

CVSS 9.3 CriticalCriticalEPSS 0.072 · 94th percentile

Critical, because:

CVSS score 9.3: 9.0 or more.

Published by the CVE Program (CNA: redhat) at 3 Nov 2023, 07:33 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: squid https://github.com/squid-cache/squid	affected 2.6 to before 6.4 semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:3.5.20-17.el7_9.13 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020231030214932.63b34585 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8090020231030224841.a75119d5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8010020231101141358.c27ad7f8 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Telecommunications Update Service Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020231101135052.4cda2c84 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Telecommunications Update Service Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020231101101624.522a0ee4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Package name: squid:4 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020231031165747.ad008a3a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.5-5.el9_2.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.5-6.el9_3.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support Package name: squid https://access.redhat.com/downloads/content/package-browser/	unaffected 7:5.2-1.el9_0.3 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: squid https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: squid34 https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: affected

Identifiers: CVE-2023-46846
CNA: redhat
Weakness (CWE): CWE-444
Tags: Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.2 Telecommunications Update Service
Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
HTTP request smuggling
Published: 3 Nov 2023
Updated: 25 Feb 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.3	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N	CNA (redhat)

CISA KEV Not listed.
EPSS 0.072, the 94th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 3 Nov 2023. New records show when each source confirmed them.

Sources

References from the CNA

access.redhat.com/errata/RHSA-2023:6266 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6267 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6268 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6748 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6801 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6803 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6804 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:6810 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2023:7213 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2024:11049 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2023-46846 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2245910 issue-trackingredhat
github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.