CVE-2009-2855
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to...
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
Exploit likelihood
What each source reports
NVD Score used
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
CVE-2009-2855- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
CVE-2009-2855- Updated
- 2026-11-02
EUVDEUVD-2009-2845 No score
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
EUVD-2009-2845- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7hrp-6jq3-pm4q No score
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to...
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
GHSA-7hrp-6jq3-pm4q- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
CVE-2009-2855- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2855 No score
The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
- Record
DEBIAN-CVE-2009-2855- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 2.7.STABLE7-1 | 2.7.STABLE7-1 |
squidDebian:13 |
before 2.7.STABLE7-1 | 2.7.STABLE7-1 |
squidDebian:14 |
before 2.7.STABLE7-1 | 2.7.STABLE7-1 |
squid3Debian:4.0 From an advisory covering 2 CVEs |
before 3.0.PRE5-5+etch2, plus listed versions 3.0.PRE5-53.0.PRE5-5+etch1 |
3.0.PRE5-5+etch2 |
squidDebian:4.0 From an advisory covering 2 CVEs |
before 2.6.5-6etch5, plus listed versions 2.6.5-62.6.5-6etch12.6.5-6etch22.6.5-6etch4 |
2.6.5-6etch5 |
squidDebian:5.0 From an advisory covering 2 CVEs |
before 2.7.STABLE3-4.1lenny1, plus listed versions 2.7.STABLE3-22.7.STABLE3-32.7.STABLE3-3~bpo40+12.7.STABLE3-42.7.STABLE3-4.12.7.STABLE3-4.1~bpo40+1 |
2.7.STABLE3-4.1lenny1 |
squid3Debian:5.0 From an advisory covering 2 CVEs |
before 3.0.STABLE8-3+lenny3, plus listed versions 3.0.STABLE8-23.0.STABLE8-33.0.STABLE8-3+lenny13.0.STABLE8-3+lenny2 |
3.0.STABLE8-3+lenny3 |
squidRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 7:2.6.STABLE21-6.el5 | 7:2.6.STABLE21-6.el5 |
squid-debuginfoRed Hat:enterprise_linux:5::client_workstation From an advisory covering 2 CVEs |
before 7:2.6.STABLE21-6.el5 | 7:2.6.STABLE21-6.el5 |
squidRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 7:2.6.STABLE21-6.el5 | 7:2.6.STABLE21-6.el5 |
squid-debuginfoRed Hat:enterprise_linux:5::server From an advisory covering 2 CVEs |
before 7:2.6.STABLE21-6.el5 | 7:2.6.STABLE21-6.el5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2855 is a medium vulnerability (CVSS 5.0) in Squid-cache Squid, published August 18, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 34.0%, the 98th percentile. Fixed in squid 2.7.STABLE7-1.
References
openwall.com/lists/oss-security/2009/08/03/3
securityfocus.com/bid/36091
bugs.debian.org/cgi-bin/bugreport.cgi?bug=534982
squid-cache.org/bugs/show_bug.cgi?id=2704
Show 23 moreShow less
securitytracker.com/id?1022757
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10592
bugzilla.redhat.com/show_bug.cgi?id=518182
exchange.xforce.ibmcloud.com/vulnerabilities/52610
nvd.nist.gov/vuln/detail/CVE-2009-2855
github.com/advisories/GHSA-7hrp-6jq3-pm4q
security-tracker.debian.org/tracker/CVE-2009-2855
access.redhat.com/errata/RHSA-2010:0221
security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0221.json
cve.org/CVERecord?id=CVE-2009-2855