{"id":"CVE-2016-10002","aliases":["ALPINE-CVE-2016-10002","DEBIAN-CVE-2016-10002","DLA-763-1","DSA-3745-1","EUVD-2016-1200","GHSA-mgr8-2fmh-mcqw","MGASA-2016-0423","RHSA-2017:0182","RHSA-2017:0183","SUSE-SU-2017:0110-1","SUSE-SU-2017:0116-1","SUSE-SU-2017:0128-1","UBUNTU-CVE-2016-10002","USN-3192-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP...","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07038,"percentile":0.94229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-12-22T21:41:01Z","modified":"2026-10-24T10:30:28Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"squid","fixed_in":["3.5.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"squid","fixed_in":["3.5.23-r0"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"squid3","fixed_in":["3.1.20-2.2+deb7u7"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"squid3","fixed_in":["3.4.8-6+deb8u4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-debuginfo","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-migration-script","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-sysvinit","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-debuginfo","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-migration-script","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-sysvinit","fixed_in":["7:3.5.20-2.el7_3.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid34","fixed_in":["7:3.4.14-9.el6_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid34-debuginfo","fixed_in":["7:3.4.14-9.el6_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"squid34","fixed_in":["7:3.4.14-9.el6_8.4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"squid34-debuginfo","fixed_in":["7:3.4.14-9.el6_8.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"squid3","fixed_in":["3.3.8-1ubuntu6.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"squid3","fixed_in":["3.5.12-1ubuntu7.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-r0"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.20-2.2+deb7u7"}]}],"versions":["3.1.20-2.2","3.1.20-2.2+deb7u1","3.1.20-2.2+deb7u2","3.1.20-2.2+deb7u3","3.1.20-2.2+deb7u4","3.1.20-2.2+deb7u5","3.1.20-2.2+deb7u6"]},{"source":"osv","ecosystem":"Debian:8","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-6+deb8u4"}]}],"versions":["3.4.8-6","3.4.8-6+deb8u1","3.4.8-6+deb8u2","3.4.8-6+deb8u2~bpo70+1","3.4.8-6+deb8u3"]},{"source":"osv","ecosystem":"Mageia:5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-2.el7_3.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid34","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-9.el6_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"squid34-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-9.el6_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"squid34","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-9.el6_8.4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"squid34-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-9.el6_8.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.36.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-22.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.14-22.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1ubuntu6.9"}]}],"versions":["3.3.8-1ubuntu3","3.3.8-1ubuntu4","3.3.8-1ubuntu5","3.3.8-1ubuntu6","3.3.8-1ubuntu6.1","3.3.8-1ubuntu6.2","3.3.8-1ubuntu6.3","3.3.8-1ubuntu6.4","3.3.8-1ubuntu6.6","3.3.8-1ubuntu6.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.3"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1ubuntu6.9"}]}],"versions":["3.3.8-1ubuntu3","3.3.8-1ubuntu4","3.3.8-1ubuntu5","3.3.8-1ubuntu6","3.3.8-1ubuntu6.1","3.3.8-1ubuntu6.2","3.3.8-1ubuntu6.3","3.3.8-1ubuntu6.4","3.3.8-1ubuntu6.6","3.3.8-1ubuntu6.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.3"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"http://www.squid-cache.org/Advisories/SQUID-2016_11.txt","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Patch","Vendor Advisory","fix","web","article","report"]},{"url":"http://www.securitytracker.com/id/1037513","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0183.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0182.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/94953","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.debian.org/security/2016/dsa-3745","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10002","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mgr8-2fmh-mcqw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-10002","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0423.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19970","tags":["report"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2016_10.txt","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/12/18/1","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0182","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1405941","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0182.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-10002","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10002","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0183","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0183.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170110-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016168","tags":["report"]},{"url":"https://bugzilla.suse.com/949942","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170116-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016169","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10002","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/17/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3192-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-10003","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10002","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T17:00:00Z","modified":"2024-08-06T03:07:31.821Z","updated_at":"2026-11-02T14:33:31.450804Z"}],"euvd":[{"id":"EUVD-2016-1200","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T17:00:00Z","modified":"2024-08-06T03:07:31Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-mgr8-2fmh-mcqw","title":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP...","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2022-05-14T03:57:56Z","modified":"2023-02-03T05:00:54Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:52:52.51715Z"}],"nvd":[{"id":"CVE-2016-10002","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T17:59:00.133Z","modified":"2026-06-17T00:38:52.613Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"ALPINE-CVE-2016-10002","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T17:59:00.133Z","modified":"2026-09-22T06:30:03.822780791Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-10002","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T17:59:00.133Z","modified":"2026-10-24T10:30:28.749797938Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"RHSA-2017:0182","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-15T23:58:00Z","modified":"2026-06-26T10:32:55Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0183","title":"Red Hat Security Advisory: squid34 security update","status":"published","published":"2024-09-15T23:58:06Z","modified":"2026-06-26T10:32:56Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2016-10002","description":"Incorrect processing of responses to If-None-Modified HTTP conditional requests in Squid HTTP Proxy 3.1.10 through 3.1.23, 3.2.0.3 through 3.5.22, and 4.0.1 through 4.0.16 leads to client-specific Cookie data being leaked to other clients. Attack requests can easily be crafted by a client to probe a cache for this information.","status":"published","published":"2017-01-27T00:00:00Z","modified":"2026-02-04T03:52:47.431236Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"DLA-763-1","title":"squid3 - security update","status":"published","published":"2016-12-25T00:00:00Z","modified":"2026-03-09T02:11:30.427652Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3745-1","title":"squid3 - security update","status":"published","published":"2016-12-24T00:00:00Z","modified":"2026-03-09T01:22:34.958229Z","updated_at":"2026-11-02T15:46:16.523846Z"},{"id":"MGASA-2016-0423","title":"Updated squid packages fix security vulnerabilities","description":"Incorrect processing of responses to If-None-Modified HTTP conditional\nrequests leads to client-specific Cookie data being leaked to other\nclients. Attack requests can easily be crafted by a client to probe a\ncache for this information (CVE-2016-10002).\n\nIncorrect HTTP Request header comparison results in Collapsed Forwarding\nfeature mistakenly identifying some private responses as being suitable\nfor delivery to multiple clients (CVE-2016-10003).\n","status":"published","published":"2016-12-22T21:41:01Z","modified":"2026-04-16T06:22:56.825680246Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:0110-1","title":"Security update for squid3","description":"\nThis update for squid3 fixes the following issues:\n\n- CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)\n- CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)\n","status":"published","published":"2017-01-11T16:33:16Z","modified":"2026-02-04T04:27:58.28282Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0116-1","title":"Security update for squid","description":"\nThis update for squid fixes the following issues:\n\n- CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168)\n- CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942)\n","status":"published","published":"2017-01-12T11:32:48Z","modified":"2026-02-04T02:58:25.513462Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0128-1","title":"Security update for squid","description":"\nThis update for squid fixes the following issues:\n\n- CVE-2016-10003: Prevent incorrect forwarding of cached private responses when Collapsed Forwarding feature is enabled. This allowed remote attacker (proxy user) to discover private and sensitive information about another user (bsc#1016169).\n- CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168).\n- CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942).\n","status":"published","published":"2017-01-13T15:15:19Z","modified":"2026-02-04T04:14:19.645324Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3192-1","title":"squid3 vulnerabilities","description":"Saulius Lapinskas discovered that Squid incorrectly handled processing\nHTTP conditional requests. A remote attacker could possibly use this issue\nto obtain sensitive information related to other clients' browsing\nsessions. (CVE-2016-10002)\n\nFelix Hassert discovered that Squid incorrectly handled certain HTTP\nRequest headers when using the Collapsed Forwarding feature. A remote\nattacker could possibly use this issue to obtain sensitive information\nrelated to other clients' browsing sessions. This issue only applied to\nUbuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10003)\n","status":"published","published":"2017-02-06T18:42:20Z","modified":"2026-02-10T04:41:05Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}