Every CVE Search/ Get API key

CVE-2020-14058

Moderate: squid:4 security, bug fix, and enhancement update

7.5 HighFix available

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

2.54%Up 1.0 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Record
CVE-2020-14058
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Updated
2026-11-02
CVE List No score

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Record
CVE-2020-14058
Updated
2026-11-02
EUVDEUVD-2020-6220 No score

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Record
EUVD-2020-6220
Updated
2026-11-03
OSV 7.5

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Record
CVE-2020-14058
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-14058 7.5

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.

Record
DEBIAN-CVE-2020-14058
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2021-1092 8.8

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058)

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810)

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.(CVE-2020-15811)

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.(CVE-2020-24606)

An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).(CVE-2020-11945)

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.(CVE-2020-15049)

Record
OESA-2021-1092
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2020:4743 8.5

Red Hat Security Advisory: squid:4 security, bug fix, and enhancement update

Record
RHSA-2020:4743
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2020:4743 8.5

Moderate: squid:4 security, bug fix, and enhancement update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

  • squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

  • squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

  • squid: Improper input validation in URI processor (CVE-2019-12523)

  • squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

  • squid: Heap overflow issue in URN processing (CVE-2019-12526)

  • squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

  • squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

  • squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

  • squid: Buffer overflow in URI processor (CVE-2019-18676)

  • squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

  • squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

  • squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

  • squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

  • squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

  • squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  • squid: DoS in TLS handshake (CVE-2020-14058)

  • squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

  • squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Record
RLSA-2020:4743
CVSS 3.1
8.5 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2020:4743 No score

Moderate: squid:4 security, bug fix, and enhancement update

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

  • squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

  • squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

  • squid: Improper input validation in URI processor (CVE-2019-12523)

  • squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

  • squid: Heap overflow issue in URN processing (CVE-2019-12526)

  • squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

  • squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

  • squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

  • squid: Buffer overflow in URI processor (CVE-2019-18676)

  • squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

  • squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

  • squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

  • squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

  • squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

  • squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

  • squid: DoS in TLS handshake (CVE-2020-14058)

  • squid: Request smuggling and poisoning attack against the HTTP cache (CVE-2020-15049)

  • squid: Improper input validation could result in a DoS (CVE-2020-24606)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2020:4743
Updated
2026-11-02
OSVCLSA-2021-1629902677 No score

Fix of CVE: CVE-2020-14058, CVE-2020-15049

  • CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service
  • CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack
Record
CLSA-2021-1629902677
Updated
2026-11-02
OSVCLSA-2021-1632262221 No score

Fix of CVE: CVE-2020-8517, CVE-2021-28651, CVE-2020-15049, CVE-2020-8449, CVE-2020-8450, CVE-2020-24606, CVE-2020-25097, CVE-2020-11945, CVE-2020-14058

  • CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack
  • CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service
  • CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client
  • CVE-2020-11945: fix nonce reference counter overflow allowing replay attack
  • CVE-2020-24606: fix handle of EOF in peerDigestHandleReply() leading to Denial of service
  • CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer and leading to denial of service
  • CVE-2020-8449: fix improper HTTP request validation allowing access to resources which are prohibited by security filters
  • CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow
  • CVE-2021-28651: fix memory leak leading to denial of service
Record
CLSA-2021-1632262221
Updated
2026-11-02
OSVCLSA-2021-1634925600 No score

Fixed CVEs in squid: CVE-2020-15049, CVE-2020-14058

  • CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service
  • CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack
Record
CLSA-2021-1634925600
Updated
2026-11-02
OSVCLSA-2021-1634925634 No score

Fixed 9 CVEs in squid34

  • CVE-2020-15049: fix incorrect validation of Content-Length field leading to Http smuggling and Poisoning attack
  • CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of service
  • CVE-2020-25097: fix improper input validation allowing HTTP smuggling from trusted client
  • CVE-2020-11945: fix nonce reference counter overflow allowing replay attack
  • CVE-2020-24606: fix handle of EOF in peerDigestHandleReply() leading to Denial of service
  • CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer and leading to denial of service
  • CVE-2020-8449: fix improper HTTP request validation allowing access to resources which are prohibited by security filters
  • CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow
  • CVE-2021-28651: fix memory leak leading to denial of service
Record
CLSA-2021-1634925634
Updated
2026-11-02
OSVCLSA-2025-1761575970 No score

Fix of 6 CVEs

  • SECURITY UPDATE: potential Denial of Service via TLS connection
    • debian/patches/CVE-2020-14058.patch: Fix sending of unknown validation errors to cert validator
    • CVE-2020-14058
  • SECURITY UPDATE: improper Validation of Specified Index leads to Denial of Service via TLS Handshake vulnerability
    • debian/patches/CVE-2023-46724.patch: Fix validation of certificates with CN=* due to Buffer UnderRead in SSL CN Parsing issue (#1523)
    • CVE-2023-46724
  • SECURITY UPDATE: denial of Service vulnerability in HTTP Chunked decoder due to uncontrolled recursion bug
    • debian/patches/CVE-2024-25111.patch: Fix infinite recursion when parsing HTTP chunks, prevent progress in call chain by stopping HttpStateData recursion
    • CVE-2024-25111
  • SECURITY UPDATE: denial of Service vulnerability in the NTLM authentication credentials parser due to incorrect input validation
    • debian/patches/CVE-2020-8517.patch: Fix incorrect input validation allowing writing outside of buffer and leading to denial of service
    • CVE-2020-8517
  • SECURITY UPDATE: denial of Service vulnerability against HTTP header parsing due to a Collapse of Data into Unsafe Value
    • debian/patches/CVE-2024-25617.patch: Improve handling of expanding HTTP header values to prevent DoS
    • CVE-2024-25617
  • SECURITY UPDATE: denial of Service vulnerability by a trusted server
    • debian/rules: Disable ESI due to unfixed multiple issues in ESI causing DoS by a trusted server
    • debian/control: Remove dependencies used by ESI
    • CVE-2024-45802
Record
CLSA-2025-1761575970
Updated
2026-11-02
OSVMGASA-2020-0332 No score

Updated squid packages fix security vulnerability

Due to use of a potentially dangerous function Squid and the default certificate validation helper are vulnerable to a Denial of Service attack when processing TLS certificates. This attack is limited to Squid built with OpenSSL features and opening peer or server connections for HTTPS traffic and SSL-Bump server handshakes (CVE-2020-14058).

Due to incorrect input validation Squid is vulnerable to a Request Smuggling and Poisoning attack against the HTTP cache. This attack requires an upstream server to participate in the smuggling and generate the poison response sequence. Most popular server software are not vulnerable to participation in this attack (CVE-2020-14059).

Record
MGASA-2020-0332
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libecap
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
libecap-devel
AlmaLinux:8
From an advisory covering 18 CVEs
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
squid
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 7:3.1.23-30.el6.cloudlinux.els
7:3.1.23-30.el6.cloudlinux.els
squid34
TuxCare:CentOS:6
From an advisory covering 9 CVEs
 before 7:3.4.14-16.el6.cloudlinux.els
7:3.4.14-16.el6.cloudlinux.els
squid
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 7:3.1.23-30.el6.cloudlinux.els
7:3.1.23-30.el6.cloudlinux.els
squid34
TuxCare:OracleLinux:6
From an advisory covering 9 CVEs
 before 7:3.4.14-16.el6.cloudlinux.els
7:3.4.14-16.el6.cloudlinux.els
squid
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
squid-cgi
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
squid-common
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
squid-purge
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
squid3
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
squidclient
TuxCare:Debian:10
From an advisory covering 6 CVEs
 before 4.6-1+deb10u10+tuxcare.els1
4.6-1+deb10u10+tuxcare.els1
squid
Debian:12
 before 4.12-1
4.12-1
squid
Debian:13
 before 4.12-1
4.12-1
squid
Debian:14
 before 4.12-1
4.12-1
squid
Mageia:7
From an advisory covering 2 CVEs
 before 4.12-2.mga7
4.12-2.mga7
squid
openEuler:20.03-LTS-SP1
From an advisory covering 6 CVEs
 before 4.9-6.oe1
4.9-6.oe1
libecap
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
squid-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
squid-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 18 CVEs
 before 7:4.11-3.module+el8.3.0+7851+7808b5f9
7:4.11-3.module+el8.3.0+7851+7808b5f9
libecap
Rocky Linux:8
From an advisory covering 18 CVEs
 before 0:1.0.1-2.module+el8.4.0+404+316a0dc5
0:1.0.1-2.module+el8.4.0+404+316a0dc5

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-14058 is a high vulnerability (CVSS 7.5) in Squid-cache Squid, published June 30, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.54%, the 85th percentile. Fixed in squid 4.12-1.

References

Show 121 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open