High severity · published Jan 27, 2017
CVE-2016-10003
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some…
7.5
CVSS
4.8%
EPSS
No
On KEV
Description
Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.8% · higher than 92% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SQ
Squid · Squid-cache
3.5.0.1 before 3.5.23; 4.0.1 before 4.0.17 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-10003
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-10003
Mailing List
http://www.openwall.com/lists/oss-security/2016/12/18/1
Broken Link
http://www.securityfocus.com/bid/94953
Broken Link
http://www.securitytracker.com/id/1037512
Patch
http://www.squid-cache.org/Advisories/SQUID-2016_10.txt
More from Squid
9.8
CVE-2025-54574
Squid is a caching proxy for the Web
9.8
CVE-2020-11945
An issue was discovered in Squid before 5.0.2
9.8
CVE-2019-12519
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12524
An issue was discovered in Squid through 4.7
9.8
CVE-2019-12526
An issue was discovered in Squid before 4.9