CVE-2020-24606: Canonical Ubuntu Linux

High severity, CVSS 7.5. EPSS: 5% chance of exploitation in the next 30 days.

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 20.04 only
• Debian Debian Linux: version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 31 only; version 32 only; version 33 only
• Opensuse Leap: version 15.1 only; version 15.2 only
• Squid-Cache Squid: from 3.0, before 4.13 (fixed in 4.13); from 5.0.1, before 5.0.4 (fixed in 5.0.4)

Published 2020-08-24. Last modified 2026-06-17.