Every CVE Search/ Get API key

CVE-2018-1172

This vulnerability allows remote attackers to deny service on vulnerable installations of The...

5.9 MediumFix available

CVE-2018-1172 is a medium vulnerability (CVSS 5.9) in Squid-cache Squid, published May 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 8.16%, the 94th percentile. Fixed in squid 3.5.27-r2.

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

8.16%Up 7.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
CVE-2018-1172
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-476
Updated
2026-11-02
CVE List No score

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
CVE-2018-1172
Weakness
CWE-476
Updated
2026-11-02
EUVDEUVD-2018-11810 No score

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
EUVD-2018-11810
Updated
2026-11-03
GitHub AdvisoriesGHSA-5pj9-pxj3-pc8r 5.9

This vulnerability allows remote attackers to deny service on vulnerable installations of The...

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
GHSA-5pj9-pxj3-pc8r
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-476
Updated
2026-11-02
OSVALPINE-CVE-2018-1172 5.9

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
ALPINE-CVE-2018-1172
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 5.9

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
CVE-2018-1172
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2018-1172 5.9

This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.

Record
DEBIAN-CVE-2018-1172
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2018:1122-1 No score

security update for squid

This update fixes the following issues:

  • CVE-2018-1172: Squid Proxy Cache Denial of Service vulnerability (bsc#1090089).
Record
SUSE-SU-2018:1122-1
Updated
2026-11-02
OSVSUSE-SU-2018:1365-1 No score

Security update for squid3

This update for squid3 fixes the following issues:

  • CVE-2018-1172: Fixed a DoS caused by incorrect handling of ESI responses. (bsc#1090089, SQUID-2018:3)
Record
SUSE-SU-2018:1365-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid
Alpine:v3.10
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.11
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.12
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.13
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.14
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.15
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.16
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.17
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.18
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.19
 before 3.5.27-r2
3.5.27-r2
Show 15 moreShow less
Affected packages
PackageAffectedFixed
squid
Alpine:v3.20
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.21
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.22
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.23
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.24
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.8
 before 3.5.27-r2
3.5.27-r2
squid
Alpine:v3.9
 before 3.5.27-r2
3.5.27-r2
squid
Debian:12
 before 4.1-1
4.1-1
squid
Debian:13
 before 4.1-1
4.1-1
squid
Debian:14
 before 4.1-1
4.1-1
squid
SUSE:Linux Enterprise Server 12 SP3
 before 3.5.21-26.9.1
3.5.21-26.9.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.5.21-26.9.1
3.5.21-26.9.1
squid3
SUSE:Linux Enterprise Server 11 SP4
 before 3.1.23-8.16.37.6.1
3.1.23-8.16.37.6.1
squid3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 3.1.23-8.16.37.6.1
3.1.23-8.16.37.6.1
squid
openSUSE:Tumbleweed
 before 4.16-1.5
4.16-1.5

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 43 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open