{"id":"CVE-2016-10003","aliases":["ALPINE-CVE-2016-10003","EUVD-2016-1201","GHSA-96r9-hr2x-h9g7","MGASA-2016-0423","SUSE-SU-2017:0128-1","UBUNTU-CVE-2016-10003","USN-3192-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1...","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04772,"percentile":0.91976,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-697"],"published":"2016-12-22T21:41:01Z","modified":"2026-10-24T10:30:42Z","fixes":[{"ecosystem":"Alpine:v3.2","package":"squid","fixed_in":["3.5.23-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.3","package":"squid","fixed_in":["3.5.23-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"squid3","fixed_in":["3.5.12-1ubuntu7.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0.1"},{"fixed":"3.5.23-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.5.0.1"},{"fixed":"3.5.23-r0"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-1.mga5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.3"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1ubuntu6.9"}]}],"versions":["3.3.8-1ubuntu3","3.3.8-1ubuntu4","3.3.8-1ubuntu5","3.3.8-1ubuntu6","3.3.8-1ubuntu6.1","3.3.8-1ubuntu6.2","3.3.8-1ubuntu6.3","3.3.8-1ubuntu6.4","3.3.8-1ubuntu6.6","3.3.8-1ubuntu6.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.3"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/12/18/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"http://www.securitytracker.com/id/1037512","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securityfocus.com/bid/94953","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2016_10.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10003"},{"url":"https://github.com/advisories/GHSA-96r9-hr2x-h9g7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2016-10003","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0423.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=19970","tags":["report"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2016_11.txt","tags":["web"]},{"url":"http://openwall.com/lists/oss-security/2016/12/18/1","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1016168","tags":["report"]},{"url":"https://bugzilla.suse.com/1016169","tags":["report"]},{"url":"https://bugzilla.suse.com/949942","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2016-10003","tags":["report"]},{"url":"http://www.squid-cache.org/Versions/v4/changesets/squid-4-14956.patch","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2016/12/17/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3192-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10003","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10002","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-10003","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T17:00:00Z","modified":"2024-08-06T03:07:31.873Z","updated_at":"2026-11-02T14:33:31.117878Z"}],"euvd":[{"id":"EUVD-2016-1201","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T17:00:00Z","modified":"2024-08-06T03:07:31Z","updated_at":"2026-11-03T02:22:25.285099Z"}],"ghsa":[{"id":"GHSA-96r9-hr2x-h9g7","title":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1...","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2022-05-17T02:57:52Z","modified":"2024-02-10T05:07:37Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-697"],"updated_at":"2026-11-02T14:55:35.197353Z"}],"nvd":[{"id":"CVE-2016-10003","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T17:59:00.18Z","modified":"2026-06-17T00:38:52.783Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-697"],"updated_at":"2026-11-02T14:03:35.029632Z"}],"osv":[{"id":"ALPINE-CVE-2016-10003","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T17:59:00.18Z","modified":"2026-09-22T06:17:50.314345667Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:46.318571Z"},{"id":"CVE-2016-10003","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T17:59:00.18Z","modified":"2026-10-24T10:30:42.508996568Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:01.531338Z"},{"id":"UBUNTU-CVE-2016-10003","description":"Incorrect HTTP Request header comparison in Squid HTTP Proxy 3.5.0.1 through 3.5.22, and 4.0.1 through 4.0.16 results in Collapsed Forwarding feature mistakenly identifying some private responses as being suitable for delivery to multiple clients.","status":"published","published":"2017-01-27T00:00:00Z","modified":"2026-02-04T04:25:38.642242Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"MGASA-2016-0423","title":"Updated squid packages fix security vulnerabilities","description":"Incorrect processing of responses to If-None-Modified HTTP conditional\nrequests leads to client-specific Cookie data being leaked to other\nclients. Attack requests can easily be crafted by a client to probe a\ncache for this information (CVE-2016-10002).\n\nIncorrect HTTP Request header comparison results in Collapsed Forwarding\nfeature mistakenly identifying some private responses as being suitable\nfor delivery to multiple clients (CVE-2016-10003).\n","status":"published","published":"2016-12-22T21:41:01Z","modified":"2026-04-16T06:22:56.825680246Z","updated_at":"2026-11-02T15:49:40.103088Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2017:0128-1","title":"Security update for squid","description":"\nThis update for squid fixes the following issues:\n\n- CVE-2016-10003: Prevent incorrect forwarding of cached private responses when Collapsed Forwarding feature is enabled. This allowed remote attacker (proxy user) to discover private and sensitive information about another user (bsc#1016169).\n- CVE-2016-10002: Fixed incorrect processing of responses to If-None-Modified HTTP conditional requests. This allowed responses containing private data to clients it should not have reached (bsc#1016168).\n- CVE-2014-9749: Prevent nonce replay in Digest authentication, preventing the reuse of stale auth tokens (bsc#949942).\n","status":"published","published":"2017-01-13T15:15:19Z","modified":"2026-02-04T04:14:19.645324Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"USN-3192-1","title":"squid3 vulnerabilities","description":"Saulius Lapinskas discovered that Squid incorrectly handled processing\nHTTP conditional requests. A remote attacker could possibly use this issue\nto obtain sensitive information related to other clients' browsing\nsessions. (CVE-2016-10002)\n\nFelix Hassert discovered that Squid incorrectly handled certain HTTP\nRequest headers when using the Collapsed Forwarding feature. A remote\nattacker could possibly use this issue to obtain sensitive information\nrelated to other clients' browsing sessions. This issue only applied to\nUbuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-10003)\n","status":"published","published":"2017-02-06T18:42:20Z","modified":"2026-02-10T04:41:05Z","updated_at":"2026-11-02T16:58:10.303275Z"}]}}