CVE-2005-0241
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly...
CVE-2005-0241 is a medium vulnerability (CVSS 5.0) in Squid, published February 8, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 69.7%, the 99th percentile. Fixed in squid 2.5.7-7.
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
Exploit likelihood
What each source reports
NVD Score used
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
CVE-2005-0241- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
CVE-2005-0241- Updated
- 2026-11-02
EUVDEUVD-2005-0242 No score
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
EUVD-2005-0242- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7q73-vrf9-vhjw No score
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly...
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
GHSA-7q73-vrf9-vhjw- Updated
- 2026-11-02
OSV No score
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
CVE-2005-0241- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-0241 No score
The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.
- Record
DEBIAN-CVE-2005-0241- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 2.5.7-7 | 2.5.7-7 |
squidDebian:13 |
before 2.5.7-7 | 2.5.7-7 |
squidDebian:14 |
before 2.5.7-7 | 2.5.7-7 |
squidRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squid-debuginfoRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-debuginfoRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.3 | 7:2.5.STABLE6-3.4E.3 |
squidRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squidRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
squid-debuginfoRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.7 | 7:2.5.STABLE3-6.3E.7 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/14091
kb.cert.org/vuls/id/823350
securityfocus.com/bid/12412
squid-cache.org/bugs/show_bug.cgi?id=1216
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10998
fedoranews.org/updates/FEDORA--.shtml
Show 60 moreShow less
redhat.com/support/errata/RHSA-2005-061.html
exchange.xforce.ibmcloud.com/vulnerabilities/19060
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000931
novell.com/linux/security/advisories/2005_06_squid.html
nvd.nist.gov/vuln/detail/CVE-2005-0241
github.com/advisories/GHSA-7q73-vrf9-vhjw
security-tracker.debian.org/tracker/CVE-2005-0241
access.redhat.com/errata/RHSA-2005:060
bugzilla.redhat.com/show_bug.cgi?id=145545
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_060.json
cve.org/CVERecord?id=CVE-2005-0094