CVE-2005-0174
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain...
CVE-2005-0174 is a medium vulnerability (CVSS 5.0) in Squid, published February 6, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 50.5%, the 98th percentile. Fixed in squid 2.5.7-6.
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
Exploit likelihood
What each source reports
NVD Score used
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
CVE-2005-0174- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
CVE-2005-0174- Updated
- 2026-11-02
EUVDEUVD-2005-0175 No score
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
EUVD-2005-0175- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7wg5-v5xw-j9f6 No score
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain...
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
GHSA-7wg5-v5xw-j9f6- Updated
- 2026-11-02
OSV No score
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
CVE-2005-0174- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-0174 No score
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
- Record
DEBIAN-CVE-2005-0174- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 2.5.7-6 | 2.5.7-6 |
squidDebian:13 |
before 2.5.7-6 | 2.5.7-6 |
squidDebian:14 |
before 2.5.7-6 | 2.5.7-6 |
squidRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-debuginfoRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
redhat.com/archives/fedora-announce-list/2005-May/msg00025.html
squid-cache.org/Versions/v2/2.5/bugs
securityfocus.com/bid/12412
fedoranews.org/updates/FEDORA--.shtml
kb.cert.org/vuls/id/768702
www3.br.squid-cache.org/Advisories/SQUID-2005_4.txt
Show 60 moreShow less
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000931
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10656
mandriva.com/security/advisories?name=MDKSA-2005:034
marc.info?l=bugtraq&m=110780531820947&w=2
novell.com/linux/security/advisories/2005_06_squid.html
nvd.nist.gov/vuln/detail/CVE-2005-0174
github.com/advisories/GHSA-7wg5-v5xw-j9f6
security-tracker.debian.org/tracker/CVE-2005-0174
access.redhat.com/errata/RHSA-2005:060
bugzilla.redhat.com/show_bug.cgi?id=145545
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_060.json
cve.org/CVERecord?id=CVE-2005-0094