Every CVE Search/ Get API key

CVE-2019-12527

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with...

8.8 HighFix available

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

49.0%Up 46.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
CVE-2019-12527
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-787
Updated
2026-11-02
CVE List No score

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
CVE-2019-12527
Updated
2026-11-02
EUVDEUVD-2019-4122 No score

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
EUVD-2019-4122
Updated
2026-11-03
GitHub AdvisoriesGHSA-8x4r-gffh-rx7f 8.8

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with...

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
GHSA-8x4r-gffh-rx7f
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-787
Updated
2026-11-02
OSV 8.8

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
CVE-2019-12527
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2019-12527 8.8

An issue was discovered in Squid 4.0.23 through 4.7. When checking Basic Authentication with HttpHeader::getAuth, Squid uses a global buffer to store the decoded data. Squid does not check that the decoded length isn't greater than the buffer, leading to a heap-based buffer overflow with user controlled data.

Record
DEBIAN-CVE-2019-12527
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVRHSA-2019:2593 7.5

Red Hat Security Advisory: squid:4 security update

Record
RHSA-2019:2593
CVSS 3.0
7.5 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2019:2593 7.5

Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

  • squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2019:2593
CVSS 3.0
7.5 HighCVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2019:2593 No score

Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

Security Fix(es):

  • squid: heap-based buffer overflow in HttpHeader::getAuth (CVE-2019-12527)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2019:2593
Updated
2026-11-02
OSVMGASA-2019-0266 No score

Updated squid packages fix security vulnerabilities

Updated squid packages fix security vulnerabilities:

It was discovered that Squid incorrectly handled Digest authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12525).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2019-12527).

It was discovered that Squid incorrectly handled Basic authentication. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service (CVE-2019-12529).

Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it (CVE-2019-12854).

It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks (CVE-2019-13345).

The squid package has been updated to version 4.8, fixing these issues and other bugs.

Record
MGASA-2019-0266
Updated
2026-11-02
OSVopenSUSE-SU-2019:2540-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2540-1
Updated
2026-11-02
OSVopenSUSE-SU-2019:2541-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:2541-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2019:2975-1 No score

Security update for squid

This update for squid to version 4.9 fixes the following issues:

Security issues fixed:

  • CVE-2019-13345: Fixed multiple cross-site scripting vulnerabilities in cachemgr.cgi (bsc#1140738).
  • CVE-2019-12526: Fixed potential remote code execution during URN processing (bsc#1156326).
  • CVE-2019-12523,CVE-2019-18676: Fixed multiple improper validations in URI processing (bsc#1156329).
  • CVE-2019-18677: Fixed Cross-Site Request Forgery in HTTP Request processing (bsc#1156328).
  • CVE-2019-18678: Fixed incorrect message parsing which could have led to HTTP request splitting issue (bsc#1156323).
  • CVE-2019-18679: Fixed information disclosure when processing HTTP Digest Authentication (bsc#1156324).

Other issues addressed:

  • Fixed DNS failures when peer name was configured with any upper case characters
  • Fixed several rock cache_dir corruption issues
Record
SUSE-SU-2019:2975-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libecap
AlmaLinux:8
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
libecap-devel
AlmaLinux:8
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
squid
Debian:12
 before 4.8-1
4.8-1
squid
Debian:13
 before 4.8-1
4.8-1
squid
Debian:14
 before 4.8-1
4.8-1
squid
Debian:10
From an advisory covering 5 CVEs
 before 4.6-1+deb10u1, plus listed versions
4.6-1
4.6-1+deb10u1
squid
Mageia:7
From an advisory covering 5 CVEs
 before 4.8-1.mga7
4.8-1.mga7
libecap
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.0.0+4045+70edde92
0:1.0.1-2.module+el8.0.0+4045+70edde92
libecap-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.0.0+4045+70edde92
0:1.0.1-2.module+el8.0.0+4045+70edde92
libecap-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.0.0+4045+70edde92
0:1.0.1-2.module+el8.0.0+4045+70edde92
Show 10 moreShow less
Affected packages
PackageAffectedFixed
libecap-devel
Red Hat:enterprise_linux:8::appstream
 before 0:1.0.1-2.module+el8.0.0+4045+70edde92
0:1.0.1-2.module+el8.0.0+4045+70edde92
squid
Red Hat:enterprise_linux:8::appstream
 before 7:4.4-5.module+el8.0.0+4045+70edde92
7:4.4-5.module+el8.0.0+4045+70edde92
squid-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 7:4.4-5.module+el8.0.0+4045+70edde92
7:4.4-5.module+el8.0.0+4045+70edde92
squid-debugsource
Red Hat:enterprise_linux:8::appstream
 before 7:4.4-5.module+el8.0.0+4045+70edde92
7:4.4-5.module+el8.0.0+4045+70edde92
libecap
Rocky Linux:8
 before 0:1.0.1-2.module+el8.4.0+404+316a0dc5
0:1.0.1-2.module+el8.4.0+404+316a0dc5
squid
SUSE:Linux Enterprise Module for Server Applications 15
From an advisory covering 12 CVEs
 before 4.9-5.11.1
4.9-5.11.1
squid
SUSE:Linux Enterprise Module for Server Applications 15 SP1
From an advisory covering 12 CVEs
 before 4.9-5.11.1
4.9-5.11.1
squid
openSUSE:Leap 15.0
From an advisory covering 12 CVEs
 before 4.9-lp150.13.1
4.9-lp150.13.1
squid
openSUSE:Leap 15.1
From an advisory covering 12 CVEs
 before 4.9-lp151.2.7.1
4.9-lp151.2.7.1
squid
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
 before 4.16-1.5
4.16-1.5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-12527 is a high vulnerability (CVSS 8.8) in Squid-cache Squid, published July 11, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 49.0%, the 98th percentile. Fixed in libecap 1.0.1-2.module_el8.6.0+2741+01592ae8.

References

Show 77 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open