SQ
Product
squid
112
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 49Medium 30Low 1
Watch
Add squid to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-3948 | 7.5 | Apr 7 | Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause a denial of service via a crafted HTTP response, related to… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +34 more |
| CVE-2016-2572 | 7.5 | Feb 27 | http.cc in Squid 4.x before 4.0.7 relies on the HTTP status code after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure… Affected: 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; 4.0.6 |
| CVE-2016-2571 | 7.5 | Feb 27 | http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +34 more |
| CVE-2016-2570 | 7.5 | Feb 27 | The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +34 more |
| CVE-2016-2569 | 7.5 | Feb 27 | Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and… Affected: 3.0; 3.0; 3.0; 3.0; 3.0; 3.0; +34 more |
| CVE-2020-8450 | 7.3 | Feb 4 | An issue was discovered in Squid before 4.10 Affected: before 4.10 |
| CVE-2026-47729 | 6.5 | Jul 16 | Squid: Memory disclosure in FTP gateway Affected: < 7.6 |
| CVE-2026-33515 | 6.5 | Mar 26 | Squid has issues in ICP message handling Affected: < 7.5 |
| CVE-2024-23638 | 6.5 | Jan 24 | Squid is a caching proxy for the Web Affected: 5.0 through 5.9; 6.0 before 6.6 |
| CVE-2022-41317 | 6.5 | Dec 25 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6 Affected: 4.9 through 4.17; 5.0.6 before 5.7 |
| CVE-2021-46784 | 6.5 | Jul 17 | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses Affected: 3.0 through 3.5.28; 4.0 through 4.17; 5.0 before 5.6 |
| CVE-2021-31807 | 6.5 | Jun 8 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: 3.0 before 4.15; 5.0 before 5.0.6; 2.5.stable2; 2.5.stable3; 2.5.stable4; 2.5.stable5; +19 more |
| CVE-2021-33620 | 6.5 | May 28 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response Affected: before 4.15; 5.0 before 5.0.6 |
| CVE-2021-31808 | 6.5 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: before 4.15; 5.0 before 5.0.6 |
| CVE-2021-31806 | 6.5 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: before 4.15; 5.0 before 5.0.6 |
| CVE-2021-28662 | 6.5 | May 27 | An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6 Affected: 4.0.1 before 4.15; 5.0 before 5.0.6 |
| CVE-2020-15811 | 6.5 | Sep 2 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4 Affected: before 4.13; 5.0 before 5.0.4 |
| CVE-2020-15810 | 6.5 | Sep 2 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4 Affected: before 4.13; 5.0 before 5.0.4 |
| CVE-2020-14059 | 6.5 | Jun 30 | An issue was discovered in Squid 5.x before 5.0.3 Affected: 5.0 before 5.0.3 |
| CVE-2024-37894 | 6.3 | Jun 25 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more Affected: 3.0 before 6.10 |
| CVE-2019-18860 | 6.1 | Mar 20 | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi Affected: before 4.9 |
| CVE-2019-18677 | 6.1 | Nov 26 | An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length… Affected: 2.0 through 2.7; 3.0 through 3.5.28; 4.0 through 4.8; 2.7; 2.7; 2.7; +5 more |
| CVE-2019-13345 | 6.1 | Jul 5 | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter Affected: through 4.7 |
| CVE-2018-19131 | 6.1 | Nov 9 | Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors Affected: before 4.4 |
| CVE-2019-12521 | 5.9 | Apr 15 | An issue was discovered in Squid through 4.7 Affected: 3.0 through 3.5.28; 4.0 through 4.7; 5.0 through 5.0.1 |
| CVE-2019-12529 | 5.9 | Jul 11 | An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7 Affected: 2.0 before 2.7; 3.0 through 3.5.28; 4.0 through 4.7; 2.7; 2.7; 2.7; +6 more |
| CVE-2018-19132 | 5.9 | Nov 9 | Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet Affected: before 4.4 |
| CVE-2018-1172 | 5.9 | May 16 | This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318 Affected: 3.5.27 |
| CVE-2016-2390 | 5.9 | Apr 19 | The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl… Affected: through 3.5.13; 4.0.4; 4.0.5 |
| CVE-2026-50012 | 5.5 | Jul 16 | Squid: Memory corruption in cache_digest reply handling Affected: < 7.6 |
| CVE-2023-46846 | 5.3 | Nov 3 | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend… Affected: 2.6 before 6.4 |
| CVE-2021-28116 | 5.3 | Mar 9 | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data Affected: through 4.14; 5.0 through 5.0.5 |
| CVE-2019-18678 | 5.3 | Nov 26 | An issue was discovered in Squid 3.x and 4.x through 4.8 Affected: 3.0 through 3.5.28; 4.0 through 4.8 |
| CVE-2021-28652 | 4.9 | May 27 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6 Affected: 1.0 before 4.15; 5.0 before 5.0.6 |
| CVE-2019-12522 | 4.5 | Apr 15 | An issue was discovered in Squid through 4.7 Affected: through 4.7 |
| CVE-2025-59362 | 4.0 | Sep 26 | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs Affected: through 7.1 |
| CVE-2016-4053 | 3.7 | Apr 25 | Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to… Affected: 3.0; 3.1; 3.1.0.1; 3.1.0.2; 3.1.0.3; 3.1.0.4; +34 more |
| CVE-2014-9749 | – | Nov 6 | Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a stale nonce, aka "Nonce… Affected: 3.4.4; 3.4.5; 3.4.6; 3.4.7; 3.4.8; 3.4.9; +9 more |
| CVE-2015-5400 | – | Sep 28 | Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain… Affected: through 3.5.2 |
| CVE-2015-3455 | – | May 18 | Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or… Affected: 3.2.0.1; 3.2.0.2; 3.2.0.3; 3.2.0.4; 3.2.0.5; 3.2.0.6; +34 more |
| CVE-2015-0881 | – | Feb 20 | CRLF injection vulnerability in Squid before 3.1.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted header in a… Affected: through 3.1.0.18 |
| CVE-2014-7142 | – | Nov 26 | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size Affected: 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.5.1; +34 more |
| CVE-2014-7141 | – | Nov 26 | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an… Affected: 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.5.1; +34 more |
| CVE-2014-6270 | – | Sep 12 | Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash)… Affected: 2.4.stable1; 2.4.stable2; 2.4.stable3; 2.4.stable4; 2.4.stable5; 2.4.stable6; +34 more |
| CVE-2014-3609 | – | Sep 11 | HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with… Affected: 3.1; 3.1.0.1; 3.1.0.2; 3.1.0.3; 3.1.0.4; 3.1.0.5; +34 more |
| CVE-2014-0128 | – | Apr 14 | Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request,… Affected: 3.1; 3.1.0.1; 3.1.0.2; 3.1.0.3; 3.1.0.4; 3.1.0.5; +34 more |
| CVE-2013-1839 | – | Sep 30 | The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU… Affected: 3.2.0.1; 3.2.0.2; 3.2.0.3; 3.2.0.4; 3.2.0.5; 3.2.0.6; +26 more |
| CVE-2013-4123 | – | Sep 16 | client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of service via a crafted port number in a HTTP Host header Affected: 3.3.0; 3.3.0.2; 3.3.0.3; 3.3.1; 3.3.2; 3.3.3; +34 more |
| CVE-2013-4115 | – | Aug 9 | Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows remote attackers to cause a denial of service (memory… Affected: 3.2.0.2; 3.2.0.3; 3.2.0.4; 3.2.0.5; 3.2.0.6; 3.2.0.7; +11 more |
| CVE-2013-0189 | – | Feb 8 | cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted… Affected: 3.1; 3.1.0.1; 3.1.0.2; 3.1.0.3; 3.1.0.4; 3.1.0.5; +34 more |