Every CVE Search/ Get API key

CVE-2014-0128

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers...

5.0 MediumFix available

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Exploit likelihood

32.6%Up 30.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Record
CVE-2014-0128
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Record
CVE-2014-0128
Updated
2026-11-02
EUVDEUVD-2014-0191 No score

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Record
EUVD-2014-0191
Updated
2026-11-03
GitHub AdvisoriesGHSA-m2w9-x6qf-9vf9 No score

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers...

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Record
GHSA-m2w9-x6qf-9vf9
Weakness
CWE-20
Updated
2026-11-02
OSVMGASA-2014-0168 No score

Updated squid packages fix CVE-2014-0128

Updated squid packages fix security vulnerability:

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Record
MGASA-2014-0168
Updated
2026-11-02
OSVMGASA-2014-0192 No score

Updated squid package fixes CVE-2014-0128

Updated squid packages fix security vulnerability:

Due to incorrect state management, Squid before 3.3.12 is vulnerable to a denial of service attack when processing certain HTTPS requests if the SSL-Bump feature is enabled (CVE-2014-0128).

Record
MGASA-2014-0192
Updated
2026-11-02
OSVSUSE-SU-2016:2089-1 No score

Security update for squid3

This update for squid3 fixes the following issues:

  • Multiple issues in pinger ICMP processing. (CVE-2014-7141, CVE-2014-7142)

  • CVE-2016-3947: Buffer overrun issue in pinger ICMPv6 processing. (bsc#973782)

  • CVE-2016-4554: fix header smuggling issue in HTTP Request processing (bsc#979010)

  • Fix multiple Denial of Service issues in HTTP Response processing. (CVE-2016-2569, CVE-2016-2570, CVE-2016-2571, CVE-2016-2572, bsc#968392, bsc#968393, bsc#968394, bsc#968395)

  • Regression caused by the DoS fixes above (bsc#993299)

  • CVE-2016-3948: Fix denial of service in HTTP Response processing (bsc#973783)

  • CVE-2016-4051: fixes buffer overflow in cachemgr.cgi (bsc#976553)

  • CVE-2016-4052, CVE-2016-4053, CVE-2016-4054:

    • fixes multiple issues in ESI processing (bsc#976556)

  • CVE-2016-4556: fixes double free vulnerability in Esi.cc (bsc#979008)

  • CVE-2015-5400: Improper Protection of Alternate Path (bsc#938715)

  • CVE-2014-6270: fix off-by-one in snmp subsystem (bsc#895773)

  • Memory leak in squid3 when using external_acl (bsc#976708)

Record
SUSE-SU-2016:2089-1
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0128 No score

Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.

Record
UBUNTU-CVE-2014-0128
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid
Mageia:4
 before 3.3.12-1.mga4
3.3.12-1.mga4
squid
Mageia:3
 before 3.2.10-1.6.mga3
3.2.10-1.6.mga3
squid
Red Hat:enterprise_linux:6::server
 before 7:3.1.10-20.el6_5.3
7:3.1.10-20.el6_5.3
squid-debuginfo
Red Hat:enterprise_linux:6::server
 before 7:3.1.10-20.el6_5.3
7:3.1.10-20.el6_5.3
squid
Red Hat:enterprise_linux:6::workstation
 before 7:3.1.10-20.el6_5.3
7:3.1.10-20.el6_5.3
squid-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 7:3.1.10-20.el6_5.3
7:3.1.10-20.el6_5.3
squid3
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 25 CVEs
 before 3.1.23-8.16.30.1
3.1.23-8.16.30.1
squid3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 25 CVEs
 before 3.1.23-8.16.30.1
3.1.23-8.16.30.1
squid3
Ubuntu:14.04:LTS
 before 3.3.8-1ubuntu6.6, plus listed versions
3.3.8-1ubuntu33.3.8-1ubuntu43.3.8-1ubuntu53.3.8-1ubuntu63.3.8-1ubuntu6.13.3.8-1ubuntu6.23.3.8-1ubuntu6.33.3.8-1ubuntu6.4
3.3.8-1ubuntu6.6

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0128 is a medium vulnerability (CVSS 5.0) in Squid-cache Squid, published April 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 32.6%, the 98th percentile. Fixed in squid 3.3.12-1.mga4.

References

Show 63 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open