{"id":"CVE-2018-1172","aliases":["ALPINE-CVE-2018-1172","DEBIAN-CVE-2018-1172","EUVD-2018-11810","GHSA-5pj9-pxj3-pc8r","SUSE-SU-2018:1122-1","SUSE-SU-2018:1365-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"This vulnerability allows remote attackers to deny service on vulnerable installations of The...","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08157,"percentile":0.94892,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2018-05-02T06:03:05Z","modified":"2026-10-24T10:30:18Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"squid","fixed_in":["3.5.27-r2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["4.1-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"squid","fixed_in":["3.5.21-26.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"squid","fixed_in":["3.5.21-26.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"squid3","fixed_in":["3.1.23-8.16.37.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"squid3","fixed_in":["3.1.23-8.16.37.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-r2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1-1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"squid-cache","product":"squid"},{"vendor":"the squid software foundation","product":"the squid software foundation squid"}],"references":[{"url":"https://zerodayinitiative.com/advisories/ZDI-18-309","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.squid-cache.org/Advisories/SQUID-2018_3.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1172"},{"url":"https://github.com/advisories/GHSA-5pj9-pxj3-pc8r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-1172","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1172","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181122-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1090089","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181365-1/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1172","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:00:00Z","modified":"2024-08-05T03:51:48.966Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11810","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:00:00Z","modified":"2024-08-05T03:51:48Z","updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-5pj9-pxj3-pc8r","title":"This vulnerability allows remote attackers to deny service on vulnerable installations of The...","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2022-05-13T01:33:27Z","modified":"2023-02-01T05:08:34Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:50:47.846536Z"}],"nvd":[{"id":"CVE-2018-1172","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:29:00.28Z","modified":"2026-06-17T01:50:38.257Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:04:27.507872Z"}],"osv":[{"id":"ALPINE-CVE-2018-1172","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:29:00.28Z","modified":"2026-10-23T17:17:55.205174272Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"CVE-2018-1172","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:29:00.28Z","modified":"2026-10-24T10:30:18.246569302Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.934182Z"},{"id":"DEBIAN-CVE-2018-1172","description":"This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.","status":"published","published":"2018-05-16T21:29:00.28Z","modified":"2026-10-23T18:02:57.80423706Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1122-1","title":"security update for squid","description":"\n  This update fixes the following issues:\n  \n  -  CVE-2018-1172: Squid Proxy Cache Denial of Service vulnerability (bsc#1090089).\n  ","status":"published","published":"2018-05-02T06:03:05Z","modified":"2026-02-04T04:32:48.464282Z","updated_at":"2026-11-02T15:53:44.594517Z"},{"id":"SUSE-SU-2018:1365-1","title":"Security update for squid3","description":"This update for squid3 fixes the following issues:\n\n- CVE-2018-1172: Fixed a DoS caused by incorrect handling of ESI responses. (bsc#1090089, SQUID-2018:3)\n","status":"published","published":"2018-05-22T07:50:16Z","modified":"2026-02-04T02:49:55.80722Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}