CVE-2016-2571 — Improper Input Validation in Squid

CWE-20 — Improper Input ValidationCWE-228 — Improper Handling of Syntactically Invalid Structure12 documents8 sources
Severity
7.5HIGHNVD
OSV6.8
EPSS
14.3%
top 5.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Squid-cache Squid
Timeline
PublishedFeb 27
Latest updateMay 14

Description

http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storage of certain data after a response-parsing failure, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a malformed response.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

▶NVDsquid-cache/squid133 versions+132

🔴Vulnerability Details

5
GHSA
GHSA-rwpp-43vh-q454: http↗2022-05-14
▶
OSV
squid3 vulnerabilities↗2018-02-05
▶
OSV
squid3 vulnerabilities↗2016-03-07
▶
CVEList
CVE-2016-2571: http↗2016-02-27
▶
OSV
CVE-2016-2571: http↗2016-02-27
▶

📋Vendor Advisories

4
Ubuntu
Squid vulnerabilities↗2018-02-05
▶
Ubuntu
Squid vulnerabilities↗2016-03-07
▶
Red Hat
squid: wrong error handling for malformed HTTP responses↗2016-02-24
▶
Debian
CVE-2016-2571: squid - http.cc in Squid 3.x before 3.5.15 and 4.x before 4.0.7 proceeds with the storag...↗2016
▶

💬Community

2
Bugzilla
CVE-2016-2571 CVE-2016-2572 squid: wrong error handling for malformed HTTP responses↗2016-02-26
▶
Bugzilla
CVE-2016-2569 CVE-2016-2570 CVE-2016-2571 CVE-2016-2572 squid: SQUID-2016_2 advisory, multiple DoS issues[fedora-all]↗2016-02-26
▶
CVE-2016-2571 — Improper Input Validation in Squid | cvebase