Every CVE Search/ Get API key

CVE-2016-10002

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP...

7.5 HighFix available

CVE-2016-10002 is a high vulnerability (CVSS 7.5) in Squid-cache Squid, published December 22, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.04%, the 94th percentile. Fixed in squid 3.5.23-r0.

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

7.04%Up 5.9 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
CVE-2016-10002
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
CVE-2016-10002
Updated
2026-11-02
EUVDEUVD-2016-1200 No score

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
EUVD-2016-1200
Updated
2026-11-03
GitHub AdvisoriesGHSA-mgr8-2fmh-mcqw 7.5

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP...

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
GHSA-mgr8-2fmh-mcqw
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVALPINE-CVE-2016-10002 7.5

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
ALPINE-CVE-2016-10002
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSV 7.5

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
CVE-2016-10002
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2017:0182 5.3

Red Hat Security Advisory: squid security update

Record
RHSA-2017:0182
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVRHSA-2017:0183 5.3

Red Hat Security Advisory: squid34 security update

Record
RHSA-2017:0183
CVSS 3.0
5.3 MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2016-10002 7.5

Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.

Record
UBUNTU-CVE-2016-10002
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVMGASA-2016-0423 No score

Updated squid packages fix security vulnerabilities

Incorrect processing of responses to If-None-Modified HTTP conditional requests leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information (CVE-2016-10002).

Incorrect HTTP Request header comparison results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients (CVE-2016-10003).

Record
MGASA-2016-0423
Updated
2026-11-02
OSVopenSUSE-SU-2024:11403-1 No score

squid-4.16-1.5 on GA media

These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11403-1
Updated
2026-11-02
OSVSUSE-SU-2017:0110-1 No score

Security update for squid3

This update for squid3 fixes the following issues:

  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)
Record
SUSE-SU-2017:0110-1
Updated
2026-11-02
OSVSUSE-SU-2017:0116-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)
Record
SUSE-SU-2017:0116-1
Updated
2026-11-02
OSVSUSE-SU-2017:0128-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2016-10003: Prevent incorrect forwarding of cached private responses when Collapsed Forwarding feature is enabled. This allowed remote attacker (proxy user) to discover private and sensitive information about another user (bsc#1016169).
  • CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168).
  • CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942).
Record
SUSE-SU-2017:0128-1
Updated
2026-11-02
OSVUSN-3192-1 No score

squid3 vulnerabilities

Saulius Lapinskas discovered that Squid incorrectly handled processing HTTP conditional requests. A remote attacker could possibly use this issue to obtain sensitive information related to other clients' browsing sessions. (CVE-2016-10002)

Felix Hassert discovered that Squid incorrectly handled certain HTTP Request headers when using the Collapsed Forwarding feature. A remote attacker could possibly use this issue to obtain sensitive information related to other clients' browsing sessions. This issue only applied to Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10003)

Record
USN-3192-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
squid
Alpine:v3.2
 before 3.5.23-r0
3.5.23-r0
squid
Alpine:v3.3
 before 3.5.23-r0
3.5.23-r0
squid3
Debian:7
 before 3.1.20-2.2+deb7u7, plus listed versions
3.1.20-2.23.1.20-2.2+deb7u13.1.20-2.2+deb7u23.1.20-2.2+deb7u33.1.20-2.2+deb7u43.1.20-2.2+deb7u53.1.20-2.2+deb7u6
3.1.20-2.2+deb7u7
squid3
Debian:8
 before 3.4.8-6+deb8u4, plus listed versions
3.4.8-63.4.8-6+deb8u13.4.8-6+deb8u23.4.8-6+deb8u2~bpo70+13.4.8-6+deb8u3
3.4.8-6+deb8u4
squid
Mageia:5
 before 3.5.23-1.mga5
3.5.23-1.mga5
squid
Red Hat:enterprise_linux:7::server
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid-debuginfo
Red Hat:enterprise_linux:7::server
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid-migration-script
Red Hat:enterprise_linux:7::server
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid-sysvinit
Red Hat:enterprise_linux:7::server
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid
Red Hat:enterprise_linux:7::workstation
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
Show 17 moreShow less
Affected packages
PackageAffectedFixed
squid-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid-migration-script
Red Hat:enterprise_linux:7::workstation
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid-sysvinit
Red Hat:enterprise_linux:7::workstation
 before 7:3.5.20-2.el7_3.2
7:3.5.20-2.el7_3.2
squid34
Red Hat:enterprise_linux:6::server
 before 7:3.4.14-9.el6_8.4
7:3.4.14-9.el6_8.4
squid34-debuginfo
Red Hat:enterprise_linux:6::server
 before 7:3.4.14-9.el6_8.4
7:3.4.14-9.el6_8.4
squid34
Red Hat:enterprise_linux:6::workstation
 before 7:3.4.14-9.el6_8.4
7:3.4.14-9.el6_8.4
squid34-debuginfo
Red Hat:enterprise_linux:6::workstation
 before 7:3.4.14-9.el6_8.4
7:3.4.14-9.el6_8.4
squid3
SUSE:Linux Enterprise Server 11 SP4
 before 3.1.23-8.16.36.1
3.1.23-8.16.36.1
squid3
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 3.1.23-8.16.36.1
3.1.23-8.16.36.1
squid
SUSE:Linux Enterprise Server 12 SP1
 before 3.3.14-22.6.1
3.3.14-22.6.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.3.14-22.6.1
3.3.14-22.6.1
squid
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 3.5.21-25.1
3.5.21-25.1
squid
SUSE:Linux Enterprise Server 12 SP2
 before 3.5.21-25.1
3.5.21-25.1
squid
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.5.21-25.1
3.5.21-25.1
squid3
Ubuntu:14.04:LTS
 before 3.3.8-1ubuntu6.9, plus listed versions
3.3.8-1ubuntu33.3.8-1ubuntu43.3.8-1ubuntu53.3.8-1ubuntu63.3.8-1ubuntu6.1
Show 5 moreShow less
3.3.8-1ubuntu6.23.3.8-1ubuntu6.33.3.8-1ubuntu6.43.3.8-1ubuntu6.63.3.8-1ubuntu6.8
3.3.8-1ubuntu6.9
squid3
Ubuntu:16.04:LTS
 before 3.5.12-1ubuntu7.3, plus listed versions
3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.13.5.12-1ubuntu7.2
3.5.12-1ubuntu7.3
squid
openSUSE:Tumbleweed
 before 4.16-1.5
4.16-1.5

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 66 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open