{"id":"CVE-2020-25097","aliases":["ALPINE-CVE-2020-25097","ALSA-2021:1979","CLSA-2021-1632262221","CLSA-2021-1634925634","DEBIAN-CVE-2020-25097","DLA-2598-1","DSA-4873-1","EUVD-2020-17789","GHSA-jvf6-h9gj-pmj6","MGASA-2021-0237","OESA-2021-1165","RHSA-2021:1135","RHSA-2021:1979","RHSA-2021:2025","RLSA-2021:1979","SUSE-SU-2021:1838-1","SUSE-SU-2021:1961-1","SUSE-SU-2022:14914-1","SUSE-SU-2022:2392-1","UBUNTU-CVE-2020-25097","USN-4895-1","openSUSE-SU-2021:0879-1","openSUSE-SU-2021:1961-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"Important: squid:4 security update","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.07343,"percentile":0.94438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-444"],"published":"2021-03-19T00:00:00Z","modified":"2026-10-29T11:00:55Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"squid","fixed_in":["4.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"squid","fixed_in":["4.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"squid","fixed_in":["4.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["5.0.5-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libecap","fixed_in":["1.0.1-2.module_el8.6.0+2741+01592ae8"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"libecap-devel","fixed_in":["1.0.1-2.module_el8.6.0+2741+01592ae8"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["4.13-8"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["4.13-8"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["4.13-8"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"squid3","fixed_in":["3.5.23-5+deb9u6"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"squid","fixed_in":["4.6-1+deb10u5"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"squid","fixed_in":["4.9-7.oe1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-debuginfo","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-migration-script","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-sysvinit","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-debuginfo","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-migration-script","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-sysvinit","fixed_in":["7:3.5.20-17.el7_9.6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","fixed_in":["7:4.11-4.module+el8.4.0+10676+a969168e.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","fixed_in":["7:4.11-4.module+el8.4.0+10676+a969168e.2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","fixed_in":["7:4.11-4.module+el8.4.0+10676+a969168e.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-debuginfo","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-debugsource","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-devel","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid","fixed_in":["7:4.4-8.module+el8.1.0+10584+c769fd35.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid-debuginfo","fixed_in":["7:4.4-8.module+el8.1.0+10584+c769fd35.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid-debugsource","fixed_in":["7:4.4-8.module+el8.1.0+10584+c769fd35.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-debuginfo","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-debugsource","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-devel","fixed_in":["0:1.0.1-2.module+el8.1.0+4044+36416a77"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid","fixed_in":["7:4.4-8.module+el8.2.0+10583+6e4ac934.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid-debuginfo","fixed_in":["7:4.4-8.module+el8.2.0+10583+6e4ac934.3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid-debugsource","fixed_in":["7:4.4-8.module+el8.2.0+10583+6e4ac934.3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"libecap","fixed_in":["0:1.0.1-2.module+el8.4.0+404+316a0dc5"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"squid","fixed_in":["7:4.11-4.module+el8.4.0+404+316a0dc5.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"squid3","fixed_in":["3.5.12-1ubuntu7.16"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"squid3","fixed_in":["3.5.27-1ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"squid","fixed_in":["4.10-1ubuntu1.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"4.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"4.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"4.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0"},{"fixed":"5.0.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"squid34","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-16.el6.cloudlinux.els"}]}],"bundled":9},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"squid34","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.4.14-16.el6.cloudlinux.els"}]}],"bundled":9},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-8"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-5+deb9u6"}]}],"versions":["3.5.23-5","3.5.23-5+deb9u1","3.5.23-5+deb9u2","3.5.23-5+deb9u3","3.5.23-5+deb9u4","3.5.23-5+deb9u5"]},{"source":"osv","ecosystem":"Debian:10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u5"}]}],"versions":["4.6-1","4.6-1+deb10u1","4.6-1+deb10u2","4.6-1+deb10u3","4.6-1+deb10u4"]},{"source":"osv","ecosystem":"Mageia:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.mga7"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-7.oe1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.el7_9.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.11-4.module+el8.4.0+10676+a969168e.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.11-4.module+el8.4.0+10676+a969168e.2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.11-4.module+el8.4.0+10676+a969168e.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.1.0+10584+c769fd35.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.1.0+10584+c769fd35.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.1::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.1.0+10584+c769fd35.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.2.0+10583+6e4ac934.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.2.0+10583+6e4ac934.3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.4-8.module+el8.2.0+10583+6e4ac934.3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.4.0+404+316a0dc5"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.11-4.module+el8.4.0+404+316a0dc5.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-4.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-4.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.23-8.16.37.18.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.21-26.35.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.16"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.10"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.3"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.12-1ubuntu7.16"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.10"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.3"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-lp152.2.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"netapp","product":"cloud_manager"},{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","advisory","article","report"]},{"url":"http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix"]},{"url":"https://www.debian.org/security/2021/dsa-4873","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DJMDRVV677AJL4BZAOLCT5LMFCGBZTC2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FBXFWKIGXPERDVQXG556LLPUOCMQGERC/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O3RYBDMJCPYGOSURWDR3WJTE474UFT77/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202105-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210727-0010/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-25097","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-1979.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2020-25097","tags":["report"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2021-1632262221.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2021-1634925634.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-25097","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0237.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28799","tags":["report"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-572g-rvwr-6c7f","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/commit/fa47a3bc4d382e28e7235d08750401b910e4b13a","tags":["web"]},{"url":"https://github.com/squid-cache/squid/commit/648729b05673c6166c5d91c6ee4cda30cc164839","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1135","tags":["web","advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4981-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1165","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25097","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939925","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1135.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-25097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25097","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1979","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1979.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:2025","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2025.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2021:1979","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171164","tags":["report"]},{"url":"https://bugzilla.suse.com/1171569","tags":["report"]},{"url":"https://bugzilla.suse.com/1183436","tags":["report"]},{"url":"https://bugzilla.suse.com/1185916","tags":["report"]},{"url":"https://bugzilla.suse.com/1185918","tags":["report"]},{"url":"https://bugzilla.suse.com/1185919","tags":["report"]},{"url":"https://bugzilla.suse.com/1185921","tags":["report"]},{"url":"https://bugzilla.suse.com/1185923","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211961-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-202214914-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222392-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1200907","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-46784","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-25097","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4895-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15049","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E33JWP5CXQF3EVKKDRECX4457F2ILQP2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PR56WJLXVU76BKBW5SFENNPKF5TJSS5K/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T04:08:54Z","modified":"2024-08-04T15:26:09.61Z","updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-17789","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T04:08:54Z","modified":"2024-08-04T15:26:09Z","updated_at":"2026-11-03T03:07:18.192905Z"}],"nvd":[{"id":"CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T05:15:12.48Z","modified":"2026-06-17T03:06:22.623Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20","CWE-444"],"updated_at":"2026-11-02T14:06:37.687844Z"}],"osv":[{"id":"ALPINE-CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T05:15:12.48Z","modified":"2026-10-26T11:17:55.151601989Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T05:15:12.48Z","modified":"2026-10-24T10:47:48.813427284Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T05:15:12.48Z","modified":"2026-10-26T12:02:30.759881396Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2021-1165","title":"squid security update","description":"Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\nSecurity Fix(es):\r\n\r\nAn issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.(CVE-2020-25097)","status":"published","published":"2021-05-06T11:04:24Z","modified":"2026-08-18T01:15:34.149700407Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:1135","title":"Red Hat Security Advisory: squid security update","status":"published","published":"2024-09-16T05:38:13Z","modified":"2026-06-26T10:53:42Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:1979","title":"Red Hat Security Advisory: squid:4 security update","status":"published","published":"2024-09-16T05:38:21Z","modified":"2025-11-22T12:20:33Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RHSA-2021:2025","title":"Red Hat Security Advisory: squid:4 security update","status":"published","published":"2024-09-16T05:38:29Z","modified":"2025-11-22T12:20:35Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"RLSA-2021:1979","title":"Important: squid:4 security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: improper input validation may allow a trusted client to perform HTTP request smuggling (CVE-2020-25097)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-05-18T17:06:56Z","modified":"2026-02-05T05:45:08.591521Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2020-25097","description":"An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.","status":"published","published":"2021-03-19T05:15:00Z","modified":"2026-02-04T03:26:51.96755Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"ALSA-2021:1979","title":"Important: squid:4 security update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nSecurity Fix(es):\n\n* squid: improper input validation may allow a trusted client to perform HTTP request smuggling (CVE-2020-25097)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2021-05-18T17:06:56Z","modified":"2026-10-29T11:00:55.72232839Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2021-1632262221","title":"Fix of CVE: CVE-2020-8517, CVE-2021-28651, CVE-2020-15049, CVE-2020-8449, CVE-2020-8450, CVE-2020-24606, CVE-2020-25097, CVE-2020-11945, CVE-2020-14058","description":"- CVE-2020-15049: fix incorrect validation of Content-Length field leading to\n  Http smuggling and Poisoning attack\n- CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of\n  service\n- CVE-2020-25097: fix improper input validation allowing HTTP smuggling from\n  trusted client\n- CVE-2020-11945: fix nonce reference counter overflow allowing replay attack\n- CVE-2020-24606: fix handle of EOF in peerDigestHandleReply() leading to Denial\n  of service\n- CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer\n  and leading to denial of service\n- CVE-2020-8449: fix improper HTTP request validation allowing access to \n  resources which are prohibited by security filters\n- CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow\n- CVE-2021-28651: fix memory leak leading to denial of service","status":"published","published":"2021-09-21T22:10:21Z","modified":"2026-10-21T10:47:14.734923034Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2021-1634925634","title":"Fixed 9 CVEs in squid34","description":"- CVE-2020-15049: fix incorrect validation of Content-Length field leading to\n  Http smuggling and Poisoning attack\n- CVE-2020-14058: fix handling of unknown SSL errors which resulted in denial of\n  service\n- CVE-2020-25097: fix improper input validation allowing HTTP smuggling from\n  trusted client\n- CVE-2020-11945: fix nonce reference counter overflow allowing replay attack\n- CVE-2020-24606: fix handle of EOF in peerDigestHandleReply() leading to Denial\n  of service\n- CVE-2020-8517: fix incorrect input validation allowing writing outside of buffer\n  and leading to denial of service\n- CVE-2020-8449: fix improper HTTP request validation allowing access to \n  resources which are prohibited by security filters\n- CVE-2020-8450: fix incorrect buffer managment leading to buffer overflow\n- CVE-2021-28651: fix memory leak leading to denial of service","status":"published","published":"2021-10-22T18:00:34Z","modified":"2026-10-21T10:46:44.702745805Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-2598-1","title":"squid3 - security update","status":"published","published":"2021-03-19T00:00:00Z","modified":"2026-03-09T01:21:21.285282Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4873-1","title":"squid - security update","status":"published","published":"2021-03-23T00:00:00Z","modified":"2026-03-09T02:08:43.879386Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0237","title":"Updated squid packages fix security vulnerabilities","description":"Updated squid packages fix security vulnerabilities:\n\nDue to improper input validation Squid is vulnerable to an HTTP Request\nSmuggling attack. This problem allows a trusted client to perform HTTP\nRequest Smuggling and access services otherwise forbidden by Squid\nsecurity controls (CVE-2020-25097).\n\nJoshua Rogers discovered that Squid incorrectly handled requests with the\nurn: scheme. A remote attacker could possibly use this issue to causeSquid\nto consume resources, leading to a denial of service (CVE-2021-28651).\n\nJoshua Rogers discovered that Squid incorrectly handled requests to the Cache\nManager API. A remote attacker with access privileges could possibly use this\nissue to cause Squid to consume resources, leading to a denial of service\n(CVE-2021-28652).\n\nJoshua Rogers discovered that Squid incorrectly handled certain response\nheaders. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-28662).\n\nJoshua Rogers discovered that Squid incorrectly handled range request\nprocessing. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-31806, CVE-2021-31807,\nCVE-2021-31808).\n\nJoshua Rogers discovered that Squid incorrectly handled certain HTTP\nresponses. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-33620).\n\nThe squid package has been updated to version 4.15, fixing theese issues and\nother bugs.\n","status":"published","published":"2021-06-08T16:46:03Z","modified":"2026-04-16T04:42:50.616141523Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0879-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-16T13:54:15Z","modified":"2026-02-04T02:58:42.718506Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1961-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-07-11T08:50:48Z","modified":"2026-02-04T02:54:22.409605Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1838-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-06-02T14:28:33Z","modified":"2026-02-04T02:53:45.180655Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1961-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-06-11T10:56:48Z","modified":"2026-02-04T03:15:50.81708Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2022:14914-1","title":"Security update for squid3","description":"This update for squid3 fixes the following issues:\n\n- CVE-2021-28651: Fixed a denial of service issue when processing URN\n  resource identifiers (bsc#1185921).\n- CVE-2020-25097: Fixed an HTTP request smuggling issue (bsc#1183436).\n","status":"published","published":"2022-03-15T10:31:43Z","modified":"2026-02-04T04:26:35.931264Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2392-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- CVE-2020-25097: Fixed HTTP Request Smuggling (bsc#1183436)\n- CVE-2021-28651: Fixed DoS in URN processing (bsc#1185921)\n- CVE-2021-46784: Fixed DoS when processing gopher server responses (bsc#1200907)\n","status":"published","published":"2022-07-13T18:14:01Z","modified":"2026-02-04T04:21:38.335369Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-4895-1","title":"squid, squid3 vulnerabilities","description":"Alex Rousskov and Amit Klein discovered that Squid incorrectly handled\ncertain Content-Length headers. A remote attacker could possibly use this\nissue to perform an HTTP request smuggling attack, resulting in cache\npoisoning. This issue only affected Ubuntu 20.04 LTS. (CVE-2020-15049)\n\nJianjun Chen discovered that Squid incorrectly validated certain input. A\nremote attacker could use this issue to perform HTTP Request Smuggling and\npossibly access services forbidden by the security controls.\n(CVE-2020-25097)\n","status":"published","published":"2021-03-29T13:05:00Z","modified":"2026-02-10T04:42:07Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}