CVE-2025-62168: 
Squid vulnerability analysis and mitigation

A critical vulnerability (CVE-2025-62168) with a CVSS score of 10.0 was discovered in Squid, a widely used open-source caching proxy for web traffic acceleration. The vulnerability affects all Squid versions up to and including 7.1, stemming from a failure to redact HTTP authentication credentials during error handling. The flaw was discovered by Leonardo Giovannini of Doyensec and was officially disclosed on October 17, 2025 (Security Online, GitHub Advisory).

The vulnerability occurs when Squid's error page handling mechanism inadvertently includes sensitive HTTP authentication data in returned responses. The flaw specifically affects systems where debug information is embedded in administrator mailto links via the emailerrdata directive. The issue is particularly concerning as it affects all installations with emailerrdata enabled and even those without explicit HTTP Authentication configuration. The vulnerability has been assigned CWE-209 (Generation of Error Message Containing Sensitive Information) and CWE-550 (Server-generated Error Message Containing Sensitive Information) classifications (GitHub Advisory).

The vulnerability allows attackers to bypass browser security protections and obtain credentials used by trusted clients for authentication. It can expose authentication tokens used internally by web applications and backend services, particularly in environments where Squid is used for backend load balancing. This exposure could enable attackers to impersonate users, pivot deeper into networks, or compromise backend systems relying on Squid as a reverse proxy (Security Online).

The vulnerability has been fully addressed in Squid version 7.2, which implements robust credential redaction in all error handling functions. For immediate mitigation, administrators can disable debug information in administrator mailto links by configuring squid.conf with 'emailerrdata off'. The project has also published a direct code patch (0951a06) for administrators unable to immediately upgrade (GitHub Advisory).