{"id":"CVE-2009-2622","aliases":["DSA-1843-1","DSA-1843-2","EUVD-2009-2617","GHSA-ww59-3r9r-8fph"],"status":"published","title":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial...","description":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \"missing or mismatched protocol identifier,\" (2) missing or negative status value,\" (3) \"missing version,\" or (4) \"missing or invalid status number,\" related to (a) HttpMsg.cc and (b) HttpReply.cc.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.56908,"percentile":0.99073,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20"],"published":"2009-07-28T00:00:00Z","modified":"2026-06-16T23:09:51Z","affected":[{"source":"osv","ecosystem":"Debian:5.0","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.STABLE8-3+lenny1"}]}],"versions":["3.0.STABLE8-2","3.0.STABLE8-3"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.STABLE-3+lenny2"}]}],"bundled":2}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"http://www.securitytracker.com/id?1022607","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/35812","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.vupen.com/english/advisories/2009/2013","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"]},{"url":"http://secunia.com/advisories/36007","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2009_2.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:161","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2009:178","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-2622"},{"url":"https://github.com/advisories/GHSA-ww59-3r9r-8fph"}],"sources":{"cve":[{"id":"CVE-2009-2622","description":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \"missing or mismatched protocol identifier,\" (2) missing or negative status value,\" (3) \"missing version,\" or (4) \"missing or invalid status number,\" related to (a) HttpMsg.cc and (b) HttpReply.cc.","status":"published","published":"2009-07-28T17:00:00Z","modified":"2024-08-07T05:59:56.15Z","updated_at":"2026-11-02T14:33:23.041383Z"}],"euvd":[{"id":"EUVD-2009-2617","description":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \"missing or mismatched protocol identifier,\" (2) missing or negative status value,\" (3) \"missing version,\" or (4) \"missing or invalid status number,\" related to (a) HttpMsg.cc and (b) HttpReply.cc.","status":"published","published":"2009-07-28T17:00:00Z","modified":"2024-08-07T05:59:56Z","updated_at":"2026-11-03T01:39:17.005545Z"}],"ghsa":[{"id":"GHSA-ww59-3r9r-8fph","title":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial...","description":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \"missing or mismatched protocol identifier,\" (2) missing or negative status value,\" (3) \"missing version,\" or (4) \"missing or invalid status number,\" related to (a) HttpMsg.cc and (b) HttpReply.cc.","status":"published","published":"2022-05-02T03:37:06Z","modified":"2023-01-31T05:08:24Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:49:23.788915Z"}],"nvd":[{"id":"CVE-2009-2622","description":"Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) \"missing or mismatched protocol identifier,\" (2) missing or negative status value,\" (3) \"missing version,\" or (4) \"missing or invalid status number,\" related to (a) HttpMsg.cc and (b) HttpReply.cc.","status":"published","published":"2009-07-28T17:30:01.127Z","modified":"2026-06-16T23:09:51.6Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:01:36.200173Z"}],"osv":[{"id":"DSA-1843-1","title":"squid3 - denial of service","status":"published","published":"2009-07-28T00:00:00Z","modified":"2026-03-09T01:21:28.446198Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-1843-2","title":"squid3 - regression fix","status":"published","published":"2009-08-09T00:00:00Z","modified":"2026-03-09T01:21:29.847526Z","updated_at":"2026-11-02T15:46:14.734124Z"}]}}