CVE-2005-0626
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
CVE-2005-0626 is a low vulnerability (CVSS 2.6) in Squid, published March 3, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.35%, the 71st percentile. Fixed in squid 2.5.9-2.
- Severity
- 2.6 LowCVSS 2.0, NVD
- Exploit chance
- 1.35%EPSS, 71st percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.5.9-2squid +18 more
Description
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidDebian:12 | before 2.5.9-2 | 2.5.9-2 |
squidDebian:13 | before 2.5.9-2 | 2.5.9-2 |
squidDebian:14 | before 2.5.9-2 | 2.5.9-2 |
squidRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::as From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squid-debuginfoRed Hat:enterprise_linux:3::es From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-debuginfoRed Hat:enterprise_linux:3::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE3-6.3E.13 | 7:2.5.STABLE3-6.3E.13 |
squidRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::as From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::desktop From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::es From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squidRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
squid-debuginfoRed Hat:enterprise_linux:4::ws From an advisory covering 5 CVEs | before 7:2.5.STABLE6-3.4E.9 | 7:2.5.STABLE6-3.4E.9 |
What each source reports
NVD Score used
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Updated
- 2026-11-02
CVE ListNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
EUVDEUVD-2005-0627No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
EUVD-2005-0627- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h49j-p65c-g4qjNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie...
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
GHSA-h49j-p65c-g4qj- Updated
- 2026-11-02
OSVNo score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
CVE-2005-0626- Updated
- 2026-11-02
OSVDEBIAN-CVE-2005-0626No score
Race condition in Squid 2.5.STABLE7 to 2.5.STABLE9, when using the Netscape Set-Cookie recommendations for handling cookies in caches, may cause Set-Cookie headers to be sent to other users, which allows attackers to steal the related cookies.
- Record
DEBIAN-CVE-2005-0626- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
squid-cache.org/Versions/v2/2.5/bugs
fedoranews.org/updates/FEDORA--.shtml
securityfocus.com/bid/12716
usn.ubuntu.com/93-1
exchange.xforce.ibmcloud.com/vulnerabilities/19581
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11169
Show 33 moreShow less
redhat.com/support/errata/RHSA-2005-415.html
nvd.nist.gov/vuln/detail/CVE-2005-0626
github.com/advisories/GHSA-h49j-p65c-g4qj
security-tracker.debian.org/tracker/CVE-2005-0626
access.redhat.com/errata/RHSA-2005:415
bugzilla.redhat.com/show_bug.cgi?id=125007
security.access.redhat.com/data/csaf/v2/advisories/2005/rhsa-2005_415.json
cve.org/CVERecord?id=CVE-1999-0710