Unscored severity · published Aug 18, 2009
CVE-2009-2855
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that…
–
CVSS
34%
EPSS
No
On KEV
Description
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
Exploitation
Is it being used?
Exploit prediction (EPSS)34.0% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squid · Squid-cache
2.7; 2.7; 2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2855
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2855
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=31%3Bfilename=diff%3Batt=1%3Bbug=534982
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/07/20/10
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/08/03/3
www.openwall.com
http://www.openwall.com/lists/oss-security/2009/08/04/6
www.securityfocus.com
http://www.securityfocus.com/bid/36091
More from Squid
9.8
CVE-2025-54574
Squid is a caching proxy for the Web
9.8
CVE-2020-11945
An issue was discovered in Squid before 5.0.2
9.8
CVE-2019-12519
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12524
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12526
An issue was discovered in Squid before 4.9