Every CVE Search/ Get API key

CVE-2018-19132

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

5.9 MediumFix available

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

5.88%Up 4.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 5.9

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
CVE-2018-19132
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-772
Updated
2026-11-02
CVE List No score

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
CVE-2018-19132
Updated
2026-11-02
EUVDEUVD-2018-10845 No score

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
EUVD-2018-10845
Updated
2026-11-03
GitHub AdvisoriesGHSA-5vh5-r999-h6wp 5.9

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
GHSA-5vh5-r999-h6wp
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-772
Updated
2026-11-02
OSV 5.9

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
CVE-2018-19132
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-19132 5.9

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
DEBIAN-CVE-2018-19132
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVUBUNTU-CVE-2018-19132 5.9

Squid before 4.4, when SNMP is enabled, allows a denial of service (Memory Leak) via an SNMP packet.

Record
UBUNTU-CVE-2018-19132
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1777539404 No score

squid34: Fix of 12 CVEs

  • CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
  • CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
  • CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
  • CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
  • CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
  • CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
  • CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
  • CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
  • CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
  • CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads
Record
CLSA-2026-1777539404
Updated
2026-11-02
OSVCLSA-2026-1777541147 No score

squid34: Fix of 12 CVEs

  • CVE-2019-12525: fix heap buffer over-read in Digest auth parameter parsing
  • CVE-2018-1000027: fix NULL pointer dereference in X-Forwarded-For logging for internal transactions
  • CVE-2018-19131: escape certificate field injection via %D in ERR_SECURE_CONNECT_FAIL page
  • CVE-2018-19132: fix memory leak when parsing denied or malformed SNMP packets
  • CVE-2019-13345: escape user_name and pub_auth parameters in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18860: validate hostname parameter in cachemgr.cgi to prevent reflected XSS
  • CVE-2019-18677: prevent hostname truncation when append_domain expands origin-relative domains
  • CVE-2019-18679: remove in-memory pointer from Digest nonce hash input (ASLR bypass)
  • CVE-2019-18678: reject HTTP requests with BWS between header field-name and colon (RFC 7230 3.2.4)
  • CVE-2019-12523: validate URN NID per RFC 8141 to prevent SSRF via crafted urn: requests
  • CVE-2019-12528: track FTP listing token positions to avoid strstr-based over-read into adjacent heap
  • CVE-2019-12529: replace uudecode with base64_decode in Basic auth to bound input-buffer reads
Record
CLSA-2026-1777541147
Updated
2026-11-02
OSVMGASA-2018-0458 No score

Updated squid packages fix security vulnerabilities

Due to incorrect input handling, Squid is vulnerable to a Cross-Site Scripting vulnerability when generating HTTPS response messages about TLS errors (CVE-2018-19131).

Due to a memory leak in SNMP query rejection code, Squid is vulnerable to a denial of service attack (CVE-2018-19132).

Record
MGASA-2018-0458
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2018:3771-1 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3771-1
Updated
2026-11-02
OSVSUSE-SU-2018:3771-2 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3771-2
Updated
2026-11-02
OSVSUSE-SU-2018:3786-1 No score

Security update for squid

This update for squid fixes the following issues:

Security issues fixed:

  • CVE-2018-19131: Fixed Cross-Site-Scripting vulnerability in the TLS error handling (bsc#1113668).
  • CVE-2018-19132: Fixed small memory leak in processing of SNMP packets (bsc#1113669).

Non-security issues fixed:

  • Create runtime directories needed when SMP mode is enabled (bsc#1112695, bsc#1112066).
  • Install license correctly (bsc#1082318).
Record
SUSE-SU-2018:3786-1
Updated
2026-11-02
OSVUSN-4059-1 No score

squid, squid3 vulnerabilities

It was discovered that Squid incorrectly handled certain SNMP packets. A remote attacker could possibly use this issue to cause memory consumption, leading to a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19132)

It was discovered that Squid incorrectly handled the cachemgr.cgi web module. A remote attacker could possibly use this issue to conduct cross-site scripting (XSS) attacks. (CVE-2019-13345)

Record
USN-4059-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid34
TuxCare:OracleLinux:6
From an advisory covering 12 CVEs
 before 7:3.4.14-16.el6.tuxcare.els13
7:3.4.14-16.el6.tuxcare.els13
squid34
TuxCare:CentOS:6
From an advisory covering 12 CVEs
 before 7:3.4.14-16.el6.tuxcare.els13
7:3.4.14-16.el6.tuxcare.els13
squid
Debian:12
 before 4.4-1
4.4-1
squid
Debian:13
 before 4.4-1
4.4-1
squid
Debian:14
 before 4.4-1
4.4-1
squid3
Debian:8
 before 3.4.8-6+deb8u6, plus listed versions
3.4.8-63.4.8-6+deb8u13.4.8-6+deb8u23.4.8-6+deb8u2~bpo70+13.4.8-6+deb8u33.4.8-6+deb8u43.4.8-6+deb8u5
3.4.8-6+deb8u6
squid3
Debian:9
From an advisory covering 19 CVEs
 before 3.5.23-5+deb9u2, plus listed versions
3.5.23-53.5.23-5+deb9u1
3.5.23-5+deb9u2
squid
Mageia:6
From an advisory covering 2 CVEs
 before 3.5.26-1.2.mga6
3.5.26-1.2.mga6
squid
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
Show 8 moreShow less
Affected packages
PackageAffectedFixed
squid
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 3.5.21-26.12.1
3.5.21-26.12.1
squid
SUSE:Linux Enterprise Module for Server Applications 15
From an advisory covering 2 CVEs
 before 4.4-5.3.2
4.4-5.3.2
squid3
Ubuntu:16.04:LTS
 before 3.5.12-1ubuntu7.7, plus listed versions
3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1
Show 5 moreShow less
3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.6
3.5.12-1ubuntu7.7
squid3
Ubuntu:18.04:LTS
 before 3.5.27-1ubuntu1.2, plus listed versions
3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.1
3.5.27-1ubuntu1.2
squid3
Ubuntu:16.04:LTS
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.7, plus listed versions
3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1
Show 5 moreShow less
3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.6
3.5.12-1ubuntu7.7
squid3
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.2, plus listed versions
3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.1
3.5.27-1ubuntu1.2
squid
openSUSE:Tumbleweed
From an advisory covering 40 CVEs
 before 4.16-1.5
4.16-1.5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-19132 is a medium vulnerability (CVSS 5.9) in Squid-cache Squid, published November 9, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.88%, the 93rd percentile. Fixed in squid 4.4-1.

References

Show 61 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open