CVE-2016-2569

squid: some code paths fail to check bounds in string object

Published Feb 27, 2016 CVSS 3.0 · 7.5 High EPSS 31.2% KEV · Not listed
Description
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-445-1 squid3 security update
Debian DLA Debian DLA DLA-445-2 squid3 regression update
Ubuntu USN Ubuntu USN USN-3557-1 Squid vulnerabilities
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
mitre
Published
Updated
Aug 5, 2024, 11:32 PM
Reserved
Feb 26, 2016, 12:00 AM
Status
Modified
Published
Feb 27, 2016, 5:59 AM
Modified
Jun 17, 2026, 12:44 AM
Severity
Moderate
Public date
Feb 24, 2016, 12:00 AM