CVE-2012-2213

squid: URL filtering bypass

Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br

CVSS 2.0 · 5.0 Medium EPSS 12.2% KEV · Not listed

Vendors

Squid-cache

Products

Squid

CVE-2012-5643

squid: cachemgr.cgi memory usage DoS and memory leaks

Multiple memory leaks in tools/cachemgr.cc in cachemgr.cgi in Squid 2.x and 3.x before 3.1.22, 3.2.x before 3.2.4, and 3.3.x before 3.3.0.2 allow remote attackers to cause a denial of service (memory consumption) via (1) invalid Content-Length headers, (2) long POST requests, or (3) crafted authentication credentials.

CVSS 2.0 · 5.0 Medium EPSS 23.0% KEV · Not listed

Vendors

Redhat Squid-cache

Products

Enterprise Linux Squid

CVE-2013-0189

squid: Incomplete fix for the CVE-2012-5643 issue

cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.

CVSS 2.0 · 5.0 Medium EPSS 21.9% KEV · Not listed

Vendors

Canonical Squid-cache

Products

Ubuntu Linux Squid

CVE-2013-1839

Squid: strHdrAcptLangGetItem() infinite CPU loop

The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.

CVSS 2.0 · 7.8 High EPSS 17.4% KEV · Not listed

Vendors

Squid-cache

Products

Squid

CVE-2013-4115

squid: buffer overflow when processing overly long DNS names (SQUID-2013:2)

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory corruption and server termination) via a long name in a DNS lookup request.

CVSS 2.0 · 7.5 High EPSS 43.9% KEV · Not listed

Vendors

Opensuse Redhat Squid-cache

Products

Opensuse Enterprise Linux Squid

CVE-2023-46724

SQUID-2023:4 Denial of Service in SSL Certificate validation

Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.

CVSS 3.1 · 8.6 High EPSS 2.8% KEV · Not listed

Vendors

Redhat Squid-cache

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2023-49288

Denial of Service in HTTP Collapsed Forwarding in Squid

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.

CVSS 3.1 · 8.6 High EPSS 4.8% KEV · Not listed

Vendors

Redhat Squid-cache

Products

Enterprise Linux Squid

CVE-2023-49286

Denial of Service in Helper Process management

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 8.6 High EPSS 10.4% KEV · Not listed

Vendors

Redhat Squid-cache

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2023-49285

Denial of Service in HTTP Message Processing in Squid

Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 8.6 High EPSS 88.1% KEV · Not listed

Vendors

Redhat Squid-cache

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2021-46784

squid: DoS when processing gopher server responses

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.

CVSS 3.1 · 6.5 Medium EPSS 5.1% KEV · Not listed

Vendors

Debian Redhat Squid-cache

Products

Debian Linux Enterprise Linux Rhel E4s and 2 more

CVE-2021-41611

squid: improper certificate validation

An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.

CVSS 3.1 · 7.5 High EPSS 2.9% KEV · Not listed

Vendors

Fedoraproject Squid-cache

Products

Fedora Squid

CVE-2021-33620

squid: denial of service in HTTP response processing

Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.

CVSS 3.1 · 6.5 Medium EPSS 79.6% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-31808

squid: integer overflow in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.

CVSS 3.1 · 6.5 Medium EPSS 5.3% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 2 more

CVE-2021-31807

squid: incorrect memory management in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.

CVSS 3.1 · 6.5 Medium EPSS 15.6% KEV · Not listed

Vendors

Fedoraproject Netapp Redhat and 1 more

Products

Fedora Cloud Manager Enterprise Linux and 1 more

CVE-2021-31806

squid: improper input validation in HTTP Range header

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.

CVSS 3.1 · 6.5 Medium EPSS 95.3% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 2 more

CVE-2021-28662

squid: denial of service in HTTP response processing

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.

CVSS 3.1 · 6.5 Medium EPSS 71.8% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-28652

squid: denial of service issue in Cache Manager

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.

CVSS 3.1 · 4.9 Medium EPSS 4.3% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2021-28651

squid: denial of service in URN processing

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

CVSS 3.1 · 7.5 High EPSS 7.4% KEV · Not listed

Vendors

Debian Fedoraproject Netapp and 2 more

Products

Debian Linux Fedora Cloud Manager and 2 more

CVE-2021-28116

squid: out-of-bounds read in WCCP protocol data may lead to information disclosure

Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.

CVSS 3.1 · 3.7 Low EPSS 12.9% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 1 more

CVE-2020-8517

squid: Buffer Overflow in ext_lm_group_acl helper

An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients using the proxy.

CVSS 3.1 · 7.5 High EPSS 6.8% KEV · Not listed

Vendors

Canonical Opensuse Squid-cache

Products

Ubuntu Linux Leap Squid