Vulnerabilities (CVE)

Filtered by vendor Squid-cache Subscribe
Filtered by product Squid
Total 99 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2012-2213 1 Squid-cache 1 Squid 2024-04-11 5.0 MEDIUM N/A
Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br
CVE-2023-49285 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-50269 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for feature is configured. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives.
CVE-2024-23638 1 Squid-cache 1 Squid 2024-02-28 N/A 6.5 MEDIUM
Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All Squid-5.x up to and including 5.9 are vulnerable. All Squid-6.x up to and including 6.5 are vulnerable. This bug is fixed by Squid version 6.6. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. As a workaround, prevent access to Cache Manager using Squid's main access control: `http_access deny manager`.
CVE-2023-49286 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2023-49288 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forwarding" directive are not vulnerable. This bug is fixed by Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should remove all collapsed_forwarding lines from their squid.conf.
CVE-2023-46728 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Gopher support has been removed in Squid version 6.0.1. Users are advised to upgrade. Users unable to upgrade should reject all gopher URL requests.
CVE-2023-46848 2 Redhat, Squid-cache 5 Enterprise Linux, Enterprise Linux Eus, Enterprise Linux Server Aus and 2 more 2024-02-28 N/A 7.5 HIGH
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
CVE-2023-5824 2 Redhat, Squid-cache 2 Enterprise Linux, Squid 2024-02-28 N/A 7.5 HIGH
Squid is vulnerable to Denial of Service attack against HTTP and HTTPS clients due to an Improper Handling of Structural Elements bug.
CVE-2023-46846 2 Redhat, Squid-cache 8 Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Arm 64 and 5 more 2024-02-28 N/A 5.3 MEDIUM
SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems.
CVE-2023-46847 2 Redhat, Squid-cache 10 Enterprise Linux, Enterprise Linux Eus, Enterprise Linux For Arm 64 and 7 more 2024-02-28 N/A 7.5 HIGH
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
CVE-2023-46724 1 Squid-cache 1 Squid 2024-02-28 N/A 7.5 HIGH
Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted SSL Certificate in a server certificate chain. This attack is limited to HTTPS and SSL-Bump. This bug is fixed in Squid version 6.4. In addition, patches addressing this problem for the stable releases can be found in Squid's patch archives. Those who you use a prepackaged version of Squid should refer to the package vendor for availability information on updated packages.
CVE-2022-41317 1 Squid-cache 1 Squid 2024-02-28 N/A 6.5 MEDIUM
An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7.
CVE-2022-41318 1 Squid-cache 1 Squid 2024-02-28 N/A 8.6 HIGH
A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7.
CVE-2021-46784 2 Debian, Squid-cache 2 Debian Linux, Squid 2024-02-28 N/A 6.5 MEDIUM
In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.
CVE-2021-41611 2 Fedoraproject, Squid-cache 2 Fedora, Squid 2024-02-28 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services.
CVE-2021-31806 4 Debian, Fedoraproject, Netapp and 1 more 4 Debian Linux, Fedora, Cloud Manager and 1 more 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.
CVE-2021-28662 3 Debian, Fedoraproject, Squid-cache 3 Debian Linux, Fedora, Squid 2024-02-28 4.3 MEDIUM 6.5 MEDIUM
An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
CVE-2021-28651 4 Debian, Fedoraproject, Netapp and 1 more 4 Debian Linux, Fedora, Cloud Manager and 1 more 2024-02-28 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.
CVE-2021-31808 4 Debian, Fedoraproject, Netapp and 1 more 4 Debian Linux, Fedora, Cloud Manager and 1 more 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.