{"id":"CVE-2018-1000024","aliases":["ALPINE-CVE-2018-1000024","DEBIAN-CVE-2018-1000024","DLA-1266-1","DSA-4122-1","EUVD-2018-1786","GHSA-gh8j-c69q-gf38","RHSA-2020:1068","SUSE-SU-2018:0636-1","SUSE-SU-2018:0752-1","UBUNTU-CVE-2018-1000024","USN-3557-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22...","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-13","score":0.07928,"percentile":0.94813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2018-01-29T00:00:00Z","modified":"2026-10-24T10:31:04Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"squid","fixed_in":["3.5.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"squid","fixed_in":["3.5.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"squid","fixed_in":["3.5.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"squid","fixed_in":["3.5.27-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"squid3","fixed_in":["3.3.8-1ubuntu6.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"squid3","fixed_in":["3.5.12-1ubuntu7.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"squid3","fixed_in":["3.5.23-5ubuntu2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.20-2.2+deb7u8"}]}],"versions":["3.1.20-2.2","3.1.20-2.2+deb7u1","3.1.20-2.2+deb7u2","3.1.20-2.2+deb7u3","3.1.20-2.2+deb7u4","3.1.20-2.2+deb7u5","3.1.20-2.2+deb7u6","3.1.20-2.2+deb7u7"],"bundled":2},{"source":"osv","ecosystem":"Debian:8","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.8-6+deb8u5"}]}],"versions":["3.4.8-6","3.4.8-6+deb8u1","3.4.8-6+deb8u2","3.4.8-6+deb8u2~bpo70+1","3.4.8-6+deb8u3","3.4.8-6+deb8u4"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-5+deb9u1"}]}],"versions":["3.5.23-5"],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-15.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1ubuntu6.11"}]}],"versions":["3.3.8-1ubuntu3","3.3.8-1ubuntu4","3.3.8-1ubuntu5","3.3.8-1ubuntu6","3.3.8-1ubuntu6.1","3.3.8-1ubuntu6.2","3.3.8-1ubuntu6.3","3.3.8-1ubuntu6.4","3.3.8-1ubuntu6.6","3.3.8-1ubuntu6.8","3.3.8-1ubuntu6.9","3.3.8-1ubuntu6.10"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.5"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-5ubuntu2"}]}],"versions":["3.5.23-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.8-1ubuntu6.11"}]}],"versions":["3.3.8-1ubuntu3","3.3.8-1ubuntu4","3.3.8-1ubuntu5","3.3.8-1ubuntu6","3.3.8-1ubuntu6.1","3.3.8-1ubuntu6.2","3.3.8-1ubuntu6.3","3.3.8-1ubuntu6.4","3.3.8-1ubuntu6.6","3.3.8-1ubuntu6.8","3.3.8-1ubuntu6.9","3.3.8-1ubuntu6.10"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.5"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://usn.ubuntu.com/3557-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4122","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.squid-cache.org/Versions/","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/02/msg00001.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2018_1.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/4059-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000024","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gh8j-c69q-gf38"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1000024","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1000024","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1068","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1536939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1536942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1680022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717430","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727744","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1068.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000024","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000024","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1000027","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1000027","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000027","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-13345","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13345","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13345","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180636-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1077003","tags":["report"]},{"url":"https://bugzilla.suse.com/1077006","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180752-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-1000024","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3557-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4059-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-2569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2570","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2571","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-3948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-1000027","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48.901Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1786","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:00:00Z","modified":"2024-08-05T12:33:48Z","updated_at":"2026-11-03T02:39:27.400094Z"}],"ghsa":[{"id":"GHSA-gh8j-c69q-gf38","title":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22...","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2022-05-13T01:48:29Z","modified":"2023-02-02T05:01:46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:51:15.657685Z"}],"nvd":[{"id":"CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:29:00.73Z","modified":"2026-06-17T01:32:13.81Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:04:22.897995Z"}],"osv":[{"id":"ALPINE-CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:29:00.73Z","modified":"2026-10-23T17:17:55.14767953Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:29:00.73Z","modified":"2026-10-24T10:31:04.60011301Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"DEBIAN-CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-02-09T23:29:00.73Z","modified":"2026-10-23T18:03:17.336432716Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2020:1068","title":"Red Hat Security Advisory: squid security and bug fix update","status":"published","published":"2024-09-16T02:49:37Z","modified":"2026-11-13T17:43:37Z","cvss":[{"version":"3.0","score":7.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-13T19:24:29.74197Z"},{"id":"UBUNTU-CVE-2018-1000024","description":"The Squid Software Foundation Squid HTTP Caching Proxy version 3.0 to 3.5.27, 4.0 to 4.0.22 contains a Incorrect Pointer Handling vulnerability in ESI Response Processing that can result in Denial of Service for all clients using the proxy.. This attack appear to be exploitable via Remote server delivers an HTTP response payload containing valid but unusual ESI syntax.. This vulnerability appears to have been fixed in 4.0.23 and later.","status":"published","published":"2018-01-29T00:00:00Z","modified":"2026-02-04T02:55:38.270151Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1266-1","title":"squid3 - security update","status":"published","published":"2018-02-02T00:00:00Z","modified":"2026-03-09T01:00:48.360573Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4122-1","title":"squid3 - security update","status":"published","published":"2018-02-23T00:00:00Z","modified":"2026-03-09T01:18:53.013984Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:0636-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI\n  responses. This affects the default custom esi_parser (bsc#1077003).\n- CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI\n  responses or downloading intermediate CA certificates (bsc#1077006).\n","status":"published","published":"2018-03-08T17:06:50Z","modified":"2026-02-04T03:55:41.213122Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:0752-1","title":"Security update for squid3","description":"This update for squid3 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-1000024: DoS fix caused by incorrect pointer handling when processing ESI\n  responses. This affects the default custom esi_parser (bsc#1077003).\n- CVE-2018-1000027: DoS fix caused by incorrect pointer handing whien processing ESI\n  responses or downloading intermediate CA certificates (bsc#1077006).\n","status":"published","published":"2018-03-21T09:24:57Z","modified":"2026-02-04T03:49:20.193729Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"USN-3557-1","title":"squid3 vulnerabilities","description":"Mathias Fischer discovered that Squid incorrectly handled certain long\nstrings in headers. A malicious remote server could possibly cause Squid to\ncrash, resulting in a denial of service. This issue was only addressed in\nUbuntu 16.04 LTS. (CVE-2016-2569)\n\nWilliam Lima discovered that Squid incorrectly handled XML parsing when\nprocessing Edge Side Includes (ESI). A malicious remote server could\npossibly cause Squid to crash, resulting in a denial of service. This issue\nwas only addressed in Ubuntu 16.04 LTS. (CVE-2016-2570)\n\nAlex Rousskov discovered that Squid incorrectly handled response-parsing\nfailures. A malicious remote server could possibly cause Squid to crash,\nresulting in a denial of service. This issue only applied to Ubuntu 16.04\nLTS. (CVE-2016-2571)\n\nSantiago Ruano Rincón discovered that Squid incorrectly handled certain\nVary headers. A remote attacker could possibly use this issue to cause\nSquid to crash, resulting in a denial of service. This issue was only\naddressed in Ubuntu 16.04 LTS. (CVE-2016-3948)\n\nLouis Dion-Marcil discovered that Squid incorrectly handled certain Edge\nSide Includes (ESI) responses. A malicious remote server could possibly\ncause Squid to crash, resulting in a denial of service. (CVE-2018-1000024)\n\nLouis Dion-Marcil discovered that Squid incorrectly handled certain Edge\nSide Includes (ESI) responses. A malicious remote server could possibly\ncause Squid to crash, resulting in a denial of service. (CVE-2018-1000027)\n","status":"published","published":"2018-02-05T18:09:07Z","modified":"2026-02-10T04:41:16Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}