Every CVE Search/ Get API key

CVE-2018-19131

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for...

6.1 MediumPublic exploitFix available

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

3.32%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
CVE-2018-19131
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
CVE-2018-19131
Updated
2026-11-02
EUVDEUVD-2018-10844 No score

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
EUVD-2018-10844
Updated
2026-11-03
GitHub AdvisoriesGHSA-jr78-3r97-gpxf 6.1

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for...

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
GHSA-jr78-3r97-gpxf
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
CVE-2018-19131
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19131 6.1

Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.

Record
DEBIAN-CVE-2018-19131
CVSS 3.0
6.1 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
Show 10 moreShow less
OSVCLSA-2026-1776878817 No score

squid: Fix of 13 CVEs

  • CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
  • CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
  • CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
  • CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
  • CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
  • CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
  • CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
  • CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
  • CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
  • CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
  • CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
  • CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
  • CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation
Record
CLSA-2026-1776878817
Updated
2026-11-02
OSVCLSA-2026-1776879277 No score

squid: Fix of 13 CVEs

  • CVE-2018-1000027: fix NULL pointer dereference in clientFollowXForwardedForCheck for transactions without a client connection
  • CVE-2018-19131: fix XSS via X.509 certificate fields rendered unescaped in SSL error pages
  • CVE-2019-12520: prevent cache poisoning by suppressing URL userinfo from absolute URLs for non-FTP schemes
  • CVE-2019-12523: reject URIs with invalid scheme (non-alpha first char) and malformed URN NID
  • CVE-2019-12526: add Must() guard in URN response handling to prevent re-entry with zero-length buffer
  • CVE-2019-12528: fix FTP directory listing parser info leak from heap into HTTP responses
  • CVE-2019-12529: fix Basic auth uudecode out-of-bounds read/write via proper bounds checking
  • CVE-2019-13345: fix multiple XSS issues in cachemgr.cgi via rfc1738-escaping user_name and auth parameters
  • CVE-2019-18676: cap URI scheme length and reject malformed scheme prefixes to prevent buffer overflow in urlParse
  • CVE-2019-18677: prevent CSRF via append_domain truncation by rejecting oversized domain appends
  • CVE-2019-18678: reject HTTP headers with whitespace between field-name and colon per RFC 7230 to prevent request splitting
  • CVE-2019-18679: remove raw heap pointer from Digest nonce hash input to prevent information disclosure and ASLR bypass
  • CVE-2019-18860: fix cachemgr.cgi XSS/info-disclosure via hostname parameter validation
Record
CLSA-2026-1776879277
Updated
2026-11-02
OSVCLSA-2026-1777539404 No score

squid34: Fix of 12 CVEs

  • CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
  • CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
  • CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
  • CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
  • CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
  • CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
  • CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
  • CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
  • CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
  • CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads
Record
CLSA-2026-1777539404
Updated
2026-11-02
OSVCLSA-2026-1777541147 No score

squid34: Fix of 12 CVEs

  • CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
  • CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
  • CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
  • CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
  • CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
  • CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
  • CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
  • CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
  • CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
  • CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads
Record
CLSA-2026-1777541147
Updated
2026-11-02
OSVMGASA-2018-0458 No score

Updated squid packages fix security vulnerabilities

Due to incorrect input handling, Squid is vulnerable to a Cross-Site Scripting vulnerability when generating HTTPS response messages about TLS errors (CVE-2018-19131).

Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack (CVE-2018-19132).

Record
MGASA-2018-0458
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2018:3771-1 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3771-1
Updated
2026-11-02
OSVSUSE-SU-2018:3771-2 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3771-2
Updated
2026-11-02
OSVSUSE-SU-2018:3786-1 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3786-1
Updated
2026-11-02
OSVSUSE-SU-2018:3790-1 No score

Security update for squid3

This update for squid3 fixes the following issues:

Security issue fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
Record
SUSE-SU-2018:3790-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid
TuxCare:CentOS:6
From an advisory covering 13 CVEs
 before 7:3.1.23-30.el6.tuxcare.els17
7:3.1.23-30.el6.tuxcare.els17
squid
TuxCare:OracleLinux:6
From an advisory covering 13 CVEs
 before 7:3.1.23-30.el6.tuxcare.els17
7:3.1.23-30.el6.tuxcare.els17
squid34
TuxCare:OracleLinux:6
From an advisory covering 12 CVEs
 before 7:3.4.14-16.el6.tuxcare.els13
7:3.4.14-16.el6.tuxcare.els13
squid34
TuxCare:CentOS:6
From an advisory covering 12 CVEs
 before 7:3.4.14-16.el6.tuxcare.els13
7:3.4.14-16.el6.tuxcare.els13
squid
Debian:12
 before 4.4-1
4.4-1
squid
Debian:13
 before 4.4-1
4.4-1
squid
Debian:14
 before 4.4-1
4.4-1
squid
Mageia:6
From an advisory covering 2 CVEs
 before 3.5.26-1.2.mga6
3.5.26-1.2.mga6
squid
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
Show 6 moreShow less
Affected packages
PackageAffectedFixed
squid
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Module for Server Applications 15
From an advisory covering 2 CVEs
 before 4.4-5.3.2
4.4-5.3.2
squid3
SUSE:Linux Enterprise Server 11 SP4
 before 3.1.23-8.16.37.9.1
3.1.23-8.16.37.9.1
squid3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 3.1.23-8.16.37.9.1
3.1.23-8.16.37.9.1
squid
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
 before 4.16-1.5
4.16-1.5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubJonathanWilbur/CVE-2018-191312018-11-13

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19131 is a medium vulnerability (CVSS 6.1) in Squid-cache Squid, published November 9, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.32%, the 88th percentile. Fixed in squid 4.4-1.

References

Show 69 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open