Introduction
Sensitive HTTP credentials can leak to attackers through a single misconfigured proxy error page. CVE-2025-62168 is a critical flaw in Squid Proxy that lets remote parties extract authentication credentials from error messages. It affects both forward and reverse proxy deployments at scale.
About Squid: Squid is a widely used open-source caching proxy for web acceleration, access control, and content filtering. Enterprises, ISPs, and cloud providers deploy it, and there are millions of active instances. Its flexibility and performance have made it a core part of the web infrastructure in many organizations.
Technical Information
CVE-2025-62168 is caused by Squid's failure to properly redact HTTP authentication credentials in its error handling routines. When Squid hits an error while processing a client's HTTP request, it generates an error page. The email_err_data directive is enabled by default in all affected versions, and when it is on, Squid embeds a mailto link in that error page. The link carries detailed debugging information about the failed request, including HTTP headers such as Authorization.
Squid does not sanitize or remove sensitive credentials from these headers before it includes them in the error page. Any remote client or script that can trigger an error condition can therefore view the error page and pull out the usernames, passwords, or bearer tokens used for authentication. This can happen even if Squid is not explicitly configured for HTTP authentication, because credentials may be present in proxied requests for other reasons, such as backend authentication in reverse proxy setups.
The root cause sits in the error page generation code path. Squid 7.2 fixes it by redacting sensitive headers before they are included in error content.
Configuration Example
The following directive in squid.conf controls the vulnerable behavior:
# Vulnerable default (prior to 7.2) email_err_data on
To mitigate, set:
email_err_data off
Affected Systems and Versions
- All Squid versions prior to 7.2 are affected
- 3.x up to and including 3.5.28
- 4.x up to and including 4.17
- 5.x up to and including 5.9
- 6.x up to and including 6.14
- 7.x up to and including 7.1
- The vulnerability is present whether or not Squid is configured for HTTP authentication
- Both forward and reverse proxy configurations are affected
- Systems with
email_err_data on(the default) are vulnerable
Vendor Security History
Squid has a history of information disclosure and denial-of-service vulnerabilities, often in protocol parsing and error handling. Recent advisories include issues in Edge Side Includes (ESI) processing and HTTP header parsing. The project publishes clear advisories and coordinates fixes for supported versions, though older branches may not receive backports. Because Squid is open source, patches for current releases generally arrive promptly.
References
- NVD entry for CVE-2025-62168
- Official CVE entry
- Squid Security Advisory GHSA-c8cc-phh7-xmxr
- Squid commit fixing CVE-2025-62168
- Squid documentation: email_err_data
- Netgate forum discussion
- CWE-209: Generation of Error Message Containing Sensitive Information
- CWE-550: Server-generated Error Message Containing Sensitive Information
