Critical Squid Proxy Flaw (CVE-2025-62168, CVSS 10.0) Leaks HTTP Credentials and Security Tokens via Error Handling

The developers of Squid have disclosed and patched a critical information disclosure vulnerability, tracked as CVE-2025-62168 with a CVSS of 10.0, affecting all Squid versions up to and including 7.1 depending on configuration. According to Squid Project’s advisory, the flaw arises from a failure to redact HTTP Authentication credentials during error handling, potentially allowing attackers to harvest sensitive tokens or credentials used by trusted clients and backend applications.

The advisory states that this problem can allow a remote client to identify security tokens or credentials used internally by a web application using Squid for backend load balancing, and that even installations not configured with HTTP Authentication can be affected. The issue has been addressed in Squid version 7.2, which implements robust credential redaction in all error handling functions, and a direct code patch has been published for administrators unable to upgrade. For immediate mitigation, administrators are advised to disable the problematic feature by configuring squid.conf with email_err_data off.