Multiple versions of the Squid web proxy cache server built with Basic Authentication features are vulnerable to code execution and denial-of-service attacks. The vulnerability present in Squid 4.0.23 through 4.7 is caused by incorrect buffer management. Remote unauthenticated attackers could exploit the flaw with a high severity CVSS v3.0 base score of 8.0 by sending a specially crafted request to any targeted server to either execute arbitrary code or to cause Squid to crash, triggering a DoS state.
Source: https://www.bleepingcomputer.com/news/security/unpatched-squid-servers-exposed-to-dos-code-execution-attacks/