CVE-2005-0626
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Exploit likelihood
What each source reports
NVD Score used
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
EUVDEUVD-2005-0627No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
EUVD-2005-0627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h49j-p65c-g4qjNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
GHSA-h49j-p65c-g4qj- Updated
- 2026-11-02
OSVNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-0626No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
DEBIAN-CVE-2005-0626- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 | before 2.5.9-2 | 2.5.9-2 |
squidDebian:13 | before 2.5.9-2 | 2.5.9-2 |
squidDebian:14 | before 2.5.9-2 | 2.5.9-2 |
squidRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2005-0626 is a low vulnerability (CVSS 2.6) in Squid, published March 3, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in squid 2.5.9-2.
References
squid-cache.org/Versions/v2/2.5/bugs
fedoranews.org/updates/FEDORA--.shtml
securityfocus.com/bid/12716
usn.ubuntu.com/93-1
exchange.xforce.ibmcloud.com/vulnerabilities/19581
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11169
Show 33 moreShow less
redhat.com/support/errata/RHSA-2005-415.html
nvd.nist.gov/vuln/detail/CVE-2005-0626
github.com/advisories/GHSA-h49j-p65c-g4qj
security-tracker.debian.org/tracker/CVE-2005-0626
access.redhat.com/errata/RHSA-2005:415
bugzilla.redhat.com/show_bug.cgi?id=125007
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_415.json
cve.org/CVERecord?id=CVE-1999-0710