[squid-users] Squid 5.6 and 5.9 keep crashing due to signal 6 with status 0

[Flashdown]

Hello together,

yesterday an unexpected issue occured for the first time on only one of 
my squid servers, while having more than 20 of them.

The issue is that out of a sudden squid just dies with such messages 
visible in the systemctl status output for squid:

Sep 14 08:55:06 vm-myproxy squid[79100]: Squid Parent: squid-2 process 
80675 exited due to signal 6 with status 0
Sep 14 08:55:06 vm-myproxy squid[79100]: Squid Parent: squid-2 process 
80675 will not be restarted for 3600 seconds due to repeated, frequent 
failures

I tried a snapshot of april of this server and have the same results, so 
I can assure there where no changes done. We also tried a restore from 
backup as well as deploying a new server. All result in the same. Then I 
have upgraded squid last night from 5.6 on Debian 11 to 5.9 and it 
worked for the night, today the same issue happened in the morning and 
keeped happening until I found a timely coincidence with a client 
request each time the proxy dies in the access.log which looks exactly 
like these:

1694674498.411      9 **CENSORED_internal_client_IP** TCP_DENIED/407 
4129 CONNECT [ff00::]:443 - HIER_NONE/- text/html
1694674498.464      1 **CENSORED_internal_client_IP** TCP_DENIED/407 
4129 CONNECT [ff00::]:443 - HIER_NONE/- text/html
1694674499.556      7 **CENSORED_internal_client_IP** TCP_DENIED/407 
4129 CONNECT [ff00::]:443 - HIER_NONE/- text/html

So my next idea was to block all the requests of this client using 
iptables, just out of curiosity and since then squid seems to keep 
beeing up and running correctly. So does anybody know a bug that would 
match here or did I step into something new/unknown?

The client desktop PC (Windows 10) causing these requests is currently 
disconnected from the network and shutdown for further analysis and 
tests.

Our Squid is configured to require kerberos authentication and IPv6 is 
disabled via sysctl config "net.ipv6.conf.all.disable_ipv6=1" as 
currently only IPv4 is available and because ipv4_first config option of 
squid was deprecated some while ago.

The cache.log is attached to this mail.

Any idea/help is highly appreciated. Thank you!

-- 
Best regards,
Flashdown

This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager. This message contains confidential information and
is intended only for the individual named. If you are not the named
addressee you should not disseminate, distribute or copy this e-mail.
Please notify the sender immediately by e-mail if you have received
this e-mail by mistake and delete this e-mail from your system. If you
are not the intended recipient you are notified that disclosing,
copying, distributing or taking any action in reliance on the contents
of this information is strictly prohibited.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: cache.log.txt
URL: <http://lists.squid-cache.org/pipermail/squid-users/attachments/20230914/693377a8/attachment-0001.txt>