CVE-2005-0626
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
CVE-2005-0626 is a low vulnerability (CVSS 2.6) in Squid, published March 3, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in squid 2.5.9-2.
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Exploit likelihood
What each source reports
NVD Score used
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE List No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
EUVDEUVD-2005-0627 No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
EUVD-2005-0627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h49j-p65c-g4qj No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
GHSA-h49j-p65c-g4qj- Updated
- 2026-11-02
OSV No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-0626 No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
DEBIAN-CVE-2005-0626- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 2.5.9-2 | 2.5.9-2 |
squidDebian:13 |
before 2.5.9-2 | 2.5.9-2 |
squidDebian:14 |
before 2.5.9-2 | 2.5.9-2 |
squidRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-debuginfoRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::as |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::desktop |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::es |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::ws |
before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
squid-cache.org/Versions/v2/2.5/bugs
fedoranews.org/updates/FEDORA--.shtml
securityfocus.com/bid/12716
usn.ubuntu.com/93-1
exchange.xforce.ibmcloud.com/vulnerabilities/19581
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11169
Show 33 moreShow less
redhat.com/support/errata/RHSA-2005-415.html
nvd.nist.gov/vuln/detail/CVE-2005-0626
github.com/advisories/GHSA-h49j-p65c-g4qj
security-tracker.debian.org/tracker/CVE-2005-0626
access.redhat.com/errata/RHSA-2005:415
bugzilla.redhat.com/show_bug.cgi?id=125007
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_415.json
cve.org/CVERecord?id=CVE-1999-0710