CVE-2004-0189
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass...
CVE-2004-0189 is a high vulnerability (CVSS 7.5) in Squid, published March 15, 2004. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 13.8%, the 96th percentile. Fixed in squid 2.5.5-1.
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
Exploit likelihood
What each source reports
NVD Score used
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
CVE-2004-0189- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Updated
- 2026-11-02
CVE List No score
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
CVE-2004-0189- Updated
- 2026-11-02
EUVDEUVD-2004-0189 No score
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
EUVD-2004-0189- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wgp5-p97p-cph9 No score
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass...
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
GHSA-wgp5-p97p-cph9- Updated
- 2026-11-02
OSV No score
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
CVE-2004-0189- Updated
- 2026-11-02
OSVDEBIAN-CVE-2004-0189 No score
The "%xx" URL decoding function in Squid 2.5STABLE4 and earlier allows remote attackers to bypass url_regex ACLs via a URL with a NULL ("%00") character, which causes Squid to use only a portion of the requested URL when comparing it against the access control lists.
- Record
DEBIAN-CVE-2004-0189- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 |
before 2.5.5-1 | 2.5.5-1 |
squidDebian:13 |
before 2.5.5-1 | 2.5.5-1 |
squidDebian:14 |
before 2.5.5-1 | 2.5.5-1 |
squidDebian:3.0 |
before 2.4.6-2woody2 | 2.4.6-2woody2 |
squidRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squid-debuginfoRed Hat:enterprise_linux:3::as |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squidRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squid-debuginfoRed Hat:enterprise_linux:3::desktop |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squidRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squid-debuginfoRed Hat:enterprise_linux:3::es |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squidRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
squid-debuginfoRed Hat:enterprise_linux:3::ws |
before 7:2.5.STABLE3-5.3E | 7:2.5.STABLE3-5.3E |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Squid Proxy 2.4/2.5 - NULL URL Character Unauthorized Access | 2004-03-01 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
References
squid-cache.org/Advisories/SQUID-2004_1.txt
exchange.xforce.ibmcloud.com/vulnerabilities/15366
debian.org/security/2004/dsa-474
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A877
securityfocus.com/bid/9778
mandrakesoft.com/security/advisories?name=MDKSA-2004:025
Show 18 moreShow less
redhat.com/support/errata/RHSA-2004-133.html
marc.info?l=bugtraq&m=108084935904110&w=2
security.gentoo.org/glsa/glsa-200403-11.xml
distro.conectiva.com.br/atualizacoes?id=a&anuncio=000838
osvdb.org/5916
nvd.nist.gov/vuln/detail/CVE-2004-0189
github.com/advisories/GHSA-wgp5-p97p-cph9
security-tracker.debian.org/tracker/CVE-2004-0189
access.redhat.com/errata/RHSA-2004:133
microsoft.com/security/incident/spoof.asp
bugzilla.redhat.com/show_bug.cgi?id=118032
security.access.redhat.com/data/csaf/v2/advisories/2004/rhsa-2004_133.json
cve.org/CVERecord?id=CVE-2004-0189