{"id":"CVE-2023-46847","summary":"Squid: denial of service in http digest authentication","details":"Squid is vulnerable to a Denial of Service,  where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.","aliases":["GHSA-phqj-m8gv-cq4g"],"modified":"2026-08-12T03:30:13.905654829Z","published":"2023-11-03T07:58:05.641Z","related":["ALSA-2023:6266","ALSA-2023:6267","ALSA-2023:6748","ALSA-2023:7213","SUSE-SU-2023:4380-1","SUSE-SU-2023:4381-1","SUSE-SU-2023:4384-1","openSUSE-SU-2024:13398-1"],"database_specific":{"cwe_ids":["CWE-120"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46847.json","cna_assigner":"redhat"},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/01/msg00003.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6266"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6267"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6268"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6748"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6801"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6803"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6804"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6805"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6810"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:6884"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:7213"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:7576"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2023:7578"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2023-46847"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46847.json"},{"type":"ADVISORY","url":"https://github.com/squid-cache/squid/security/advisories/GHSA-phqj-m8gv-cq4g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46847"},{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20231130-0002/"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245916"},{"type":"PACKAGE","url":"https://github.com/squid-cache/squid"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/squid-cache/squid","events":[{"introduced":"04c6f6c989fb0083b3b10adfe2f438b6781c43bd"},{"fixed":"1d8175b27fc1c347649d4f221ff2633e8d800429"}],"database_specific":{"extracted_events":[{"introduced":"3.2.0.1"},{"fixed":"6.4"}],"source":["AFFECTED_FIELD","CPE_RANGE"],"cpe":"cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*"}}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-46847.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"}]}