{"id":"CVE-2021-28652","aliases":["ALPINE-CVE-2021-28652","ALSA-2021:4292","CLSA-2022-1646060698","CLSA-2025-1747855403","DEBIAN-CVE-2021-28652","DLA-2685-1","DSA-4924-1","EUVD-2021-15321","GHSA-m47m-9hvw-7447","MGASA-2021-0237","OESA-2021-1240","RHSA-2021:4292","RLSA-2021:4292","SUSE-SU-2021:1838-1","SUSE-SU-2021:1961-1","UBUNTU-CVE-2021-28652","USN-4981-1","openSUSE-SU-2021:0879-1","openSUSE-SU-2021:1961-1","openSUSE-SU-2024:11403-1"],"status":"published","title":"Moderate: squid:4 security, bug fix, and enhancement update","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","severity":{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.04341,"percentile":0.91278,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-401"],"published":"2021-05-27T00:00:00Z","modified":"2026-10-29T11:01:10Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"squid","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"squid","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"squid","fixed_in":["4.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"squid","fixed_in":["5.0.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"squid","fixed_in":["4.13-10"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"squid","fixed_in":["4.13-10"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"squid","fixed_in":["4.13-10"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"squid3","fixed_in":["3.5.27-1ubuntu1.11"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"squid","fixed_in":["4.10-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"4.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0"},{"fixed":"5.0.6-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.6.0+2741+01592ae8"}]}],"bundled":7},{"source":"osv","ecosystem":"AlmaLinux:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-3.module_el8.6.0+3010+383bc947.1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.4.0+2010+24c223d9"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-2.module_el8.4.0+2010+24c223d9"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.11-4.module_el8.4.0+2010+24c223d9.2.tuxcare.els1"}]}],"bundled":7},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.3.el7_9.10.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid-migration-script","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.3.el7_9.10.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"squid-sysvinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:3.5.20-17.0.3.el7_9.10.tuxcare.els1"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-10"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-10"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13-10"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.23-5+deb9u7"}]}],"versions":["3.5.23-5","3.5.23-5+deb9u1","3.5.23-5+deb9u2","3.5.23-5+deb9u3","3.5.23-5+deb9u4","3.5.23-5+deb9u5","3.5.23-5+deb9u6"],"bundled":6},{"source":"osv","ecosystem":"Debian:10","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u6"}]}],"versions":["4.6-1","4.6-1+deb10u1","4.6-1+deb10u2","4.6-1+deb10u3","4.6-1+deb10u4","4.6-1+deb10u5"],"bundled":7},{"source":"osv","ecosystem":"Mageia:7","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.mga7"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9-8.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"libecap-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.1.0+4044+36416a77"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-1.module+el8.5.0+11469+24c223d9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-1.module+el8.5.0+11469+24c223d9"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"squid-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-1.module+el8.5.0+11469+24c223d9"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"libecap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.1-2.module+el8.4.0+404+316a0dc5"}]}],"bundled":7},{"source":"osv","ecosystem":"Rocky Linux:8","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:4.15-1.module+el8.5.0+705+218dec94"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-4.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-4.18.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.8-1ubuntu16","3.3.8-1ubuntu17","3.5.12-1ubuntu6","3.5.12-1ubuntu7","3.5.12-1ubuntu7.1","3.5.12-1ubuntu7.2","3.5.12-1ubuntu7.3","3.5.12-1ubuntu7.4","3.5.12-1ubuntu7.5","3.5.12-1ubuntu7.6","3.5.12-1ubuntu7.7","3.5.12-1ubuntu7.8","3.5.12-1ubuntu7.9","3.5.12-1ubuntu7.10","3.5.12-1ubuntu7.11","3.5.12-1ubuntu7.12","3.5.12-1ubuntu7.13","3.5.12-1ubuntu7.14","3.5.12-1ubuntu7.15","3.5.12-1ubuntu7.16","3.5.12-1ubuntu7.16+esm1","3.5.12-1ubuntu7.16+esm2","3.5.12-1ubuntu7.16+esm3","3.5.12-1ubuntu7.16+esm4","3.5.12-1ubuntu7.16+esm5","3.5.12-1ubuntu7.16+esm6","3.5.12-1ubuntu7.16+esm7"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.11"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.4"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"squid3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.27-1ubuntu1.11"}]}],"versions":["3.5.23-5ubuntu1","3.5.23-5ubuntu2","3.5.27-1ubuntu1","3.5.27-1ubuntu1.1","3.5.27-1ubuntu1.2","3.5.27-1ubuntu1.3","3.5.27-1ubuntu1.4","3.5.27-1ubuntu1.5","3.5.27-1ubuntu1.6","3.5.27-1ubuntu1.7","3.5.27-1ubuntu1.8","3.5.27-1ubuntu1.9","3.5.27-1ubuntu1.10"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10-1ubuntu1.4"}]}],"versions":["4.8-1ubuntu2","4.8-1ubuntu3","4.9-2ubuntu1","4.9-2ubuntu2","4.9-2ubuntu3","4.9-2ubuntu4","4.10-1ubuntu1","4.10-1ubuntu1.1","4.10-1ubuntu1.2","4.10-1ubuntu1.3"],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-lp152.2.9.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15-5.26.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"squid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16-1.5"}]}],"bundled":40}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"squid-cache","product":"squid"}],"references":[{"url":"https://bugs.squid-cache.org/show_bug.cgi?id=5106","tags":["x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447","tags":["x_transferred","Patch","Third Party Advisory","fix","advisory","article","report"]},{"url":"https://www.debian.org/security/2021/dsa-4924","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00014.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/10/11/3","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://seclists.org/fulldisclosure/2023/Oct/14","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28652","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2021-4292.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2021-28651","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-28652","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-28662","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-31806","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-31807","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-31808","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2021-33620","tags":["report"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1646060698.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/rhel7-els/CLSA-2025-1747855403.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28652","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0237.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28799","tags":["report"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-jvf6-h9gj-pmj6","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-ch36-9jhx-phm4","tags":["advisory","article"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-jjq6-mh2h-g39h","tags":["advisory","article"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf","tags":["advisory","article"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-572g-rvwr-6c7f","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/commit/fa47a3bc4d382e28e7235d08750401b910e4b13a","tags":["web"]},{"url":"https://github.com/squid-cache/squid/commit/648729b05673c6166c5d91c6ee4cda30cc164839","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2021:1135","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-4981-1","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1240","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33620","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31806","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31808","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28651","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28652","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2021:4292","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1959537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962254","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1962599","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_4292.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28651","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28651","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28652","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28662","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31806","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31806","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31807","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31807","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-31808","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-31808","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33620","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33620","tags":["advisory"]},{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-572g-rvwr-6c7f/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2021:4292","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1171164","tags":["report"]},{"url":"https://bugzilla.suse.com/1171569","tags":["report"]},{"url":"https://bugzilla.suse.com/1183436","tags":["report"]},{"url":"https://bugzilla.suse.com/1185916","tags":["report"]},{"url":"https://bugzilla.suse.com/1185918","tags":["report"]},{"url":"https://bugzilla.suse.com/1185919","tags":["report"]},{"url":"https://bugzilla.suse.com/1185921","tags":["report"]},{"url":"https://bugzilla.suse.com/1185923","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-31806","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211961-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-28652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28651","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31807","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-31808","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-33620","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/E33JWP5CXQF3EVKKDRECX4457F2ILQP2/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PR56WJLXVU76BKBW5SFENNPKF5TJSS5K/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10002","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10003","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2571","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1172","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12519","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13345","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-18860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-24606","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8517","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T00:00:00Z","modified":"2024-08-03T21:47:33.045Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-15321","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T00:00:00Z","modified":"2024-08-03T21:47:33Z","updated_at":"2026-11-03T03:24:46.751124Z"}],"nvd":[{"id":"CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T12:15:08.23Z","modified":"2026-06-17T03:46:42.607Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-401"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"ALPINE-CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T12:15:08.23Z","modified":"2026-10-23T17:17:56.170649073Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T12:15:08.23Z","modified":"2026-10-24T10:50:41.327964547Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T12:15:08.23Z","modified":"2026-10-23T18:03:12.094934513Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2021-1240","title":"squid security update","description":"Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.\r\n\r\nSecurity Fix(es):\r\n\r\nSquid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.(CVE-2021-33620)\r\n\r\nAn issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.(CVE-2021-31806)\r\n\r\nAn issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.(CVE-2021-31808)\r\n\r\nAn issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.(CVE-2021-28662)\r\n\r\nAn issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.(CVE-2021-28651)\r\n\r\nAn issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.(CVE-2021-28652)","status":"published","published":"2021-06-26T11:04:28Z","modified":"2026-08-18T01:15:47.076261661Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"RHSA-2021:4292","title":"Red Hat Security Advisory: squid:4 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T06:09:33Z","modified":"2026-06-27T10:14:25Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:08.619234Z"},{"id":"RLSA-2021:4292","title":"Moderate: squid:4 security, bug fix, and enhancement update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.15). (BZ#1964384)\n\nSecurity Fix(es):\n\n* squid: denial of service in URN processing (CVE-2021-28651)\n\n* squid: denial of service issue in Cache Manager (CVE-2021-28652)\n\n* squid: denial of service in HTTP response processing (CVE-2021-28662)\n\n* squid: improper input validation in HTTP Range header (CVE-2021-31806)\n\n* squid: incorrect memory management in HTTP Range header (CVE-2021-31807)\n\n* squid: integer overflow in HTTP Range header (CVE-2021-31808)\n\n* squid: denial of service in HTTP response processing (CVE-2021-33620)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.5 Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:56:14Z","modified":"2026-02-04T21:30:05.291404Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2021-28652","description":"An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.","status":"published","published":"2021-05-27T12:15:00Z","modified":"2026-10-20T16:45:57.342309746Z","cvss":[{"version":"3.1","score":4.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"ALSA-2021:4292","title":"Moderate: squid:4 security, bug fix, and enhancement update","description":"Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.\n\nThe following packages have been upgraded to a later upstream version: squid (4.15). (BZ#1964384)\n\nSecurity Fix(es):\n\n* squid: denial of service in URN processing (CVE-2021-28651)\n\n* squid: denial of service issue in Cache Manager (CVE-2021-28652)\n\n* squid: denial of service in HTTP response processing (CVE-2021-28662)\n\n* squid: improper input validation in HTTP Range header (CVE-2021-31806)\n\n* squid: incorrect memory management in HTTP Range header (CVE-2021-31807)\n\n* squid: integer overflow in HTTP Range header (CVE-2021-31808)\n\n* squid: denial of service in HTTP response processing (CVE-2021-33620)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2021-11-09T08:56:14Z","modified":"2026-10-29T11:01:10.563188567Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"CLSA-2022-1646060698","title":"Fix of CVE: CVE-2021-31807, CVE-2021-28662, CVE-2021-33620, CVE-2021-28652, CVE-2021-28651, CVE-2021-31808, CVE-2021-31806","description":"\n- CVE-2021-28651: Fix memory leak that perform DoS via buffer-management bug\n- CVE-2021-28652: Fix cache manager URL parsing that perform DoS via incorrect parser validation \n- CVE-2021-28662: Add limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs that perform DoS via certain response header\n- CVE-2021-31806: Add handling more partial responses that perform DoS via HTTP Range request\n- CVE-2021-31807: Add handling more partial responses that perform DoS via HTTP Range request\n- CVE-2021-31808: Add handling more partial responses that perform DoS via HTTP Range request\n- CVE-2021-33620: Add handling more partial responses that perform DoS via HTTP response","status":"published","published":"2022-02-28T15:04:58Z","modified":"2026-10-21T10:48:05.086857337Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2025-1747855403","title":"squid: Fix of 6 CVEs","description":"- CVE-2021-28651: fix memory leak in RFC 2169 response parsing\n- CVE-2021-28652: fix broken cache manager URL parsing\n- CVE-2021-31806: fix memory management bug\n- CVE-2021-31807: fix integer overflow problem\n- CVE-2021-31808: fix input validation bug\n- CVE-2021-33620: handle more partial responses","status":"published","published":"2025-05-21T19:23:27Z","modified":"2026-06-01T00:33:27.416024631Z","updated_at":"2026-11-02T15:43:41.66212Z"},{"id":"DLA-2685-1","title":"squid3 - security update","status":"published","published":"2021-06-14T00:00:00Z","modified":"2026-03-09T01:22:22.343698Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4924-1","title":"squid - security update","status":"published","published":"2021-06-01T00:00:00Z","modified":"2026-03-09T02:08:43.755475Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0237","title":"Updated squid packages fix security vulnerabilities","description":"Updated squid packages fix security vulnerabilities:\n\nDue to improper input validation Squid is vulnerable to an HTTP Request\nSmuggling attack. This problem allows a trusted client to perform HTTP\nRequest Smuggling and access services otherwise forbidden by Squid\nsecurity controls (CVE-2020-25097).\n\nJoshua Rogers discovered that Squid incorrectly handled requests with the\nurn: scheme. A remote attacker could possibly use this issue to causeSquid\nto consume resources, leading to a denial of service (CVE-2021-28651).\n\nJoshua Rogers discovered that Squid incorrectly handled requests to the Cache\nManager API. A remote attacker with access privileges could possibly use this\nissue to cause Squid to consume resources, leading to a denial of service\n(CVE-2021-28652).\n\nJoshua Rogers discovered that Squid incorrectly handled certain response\nheaders. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-28662).\n\nJoshua Rogers discovered that Squid incorrectly handled range request\nprocessing. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-31806, CVE-2021-31807,\nCVE-2021-31808).\n\nJoshua Rogers discovered that Squid incorrectly handled certain HTTP\nresponses. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service (CVE-2021-33620).\n\nThe squid package has been updated to version 4.15, fixing theese issues and\nother bugs.\n","status":"published","published":"2021-06-08T16:46:03Z","modified":"2026-04-16T04:42:50.616141523Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0879-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-06-16T13:54:15Z","modified":"2026-02-04T02:58:42.718506Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:1961-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-07-11T08:50:48Z","modified":"2026-02-04T02:54:22.409605Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11403-1","title":"squid-4.16-1.5 on GA media","description":"These are all security issues fixed in the squid-4.16-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:28:26.444707Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:1838-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-06-02T14:28:33Z","modified":"2026-02-04T02:53:45.180655Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1961-1","title":"Security update for squid","description":"This update for squid fixes the following issues:\n\n- update to 4.15:\n- CVE-2021-28652: Broken cache manager URL parsing (bsc#1185918)\n- CVE-2021-28651: Memory leak in RFC 2169 response parsing (bsc#1185921)\n- CVE-2021-28662: Limit HeaderLookupTable_t::lookup() to BadHdr and specific IDs (bsc#1185919)\n- CVE-2021-31806: Handle more Range requests (bsc#1185916)\n- CVE-2020-25097: HTTP Request Smuggling vulnerability (bsc#1183436)\n- Handle more partial responses (bsc#1185923)\n- fix previous change to reinstante permissions macros, because the wrong path has been used (bsc#1171569).\n- use libexecdir instead of libdir to conform to recent changes in Factory (bsc#1171164).\n- Reinstate permissions macros for pinger binary, because the permissions\n  package is also responsible for setting up the cap_net_raw capability,\n  currently a fresh squid install doesn't get a capability bit at all (bsc#1171569).\n- Change pinger and basic_pam_auth helper to use standard permissions. pinger uses cap_net_raw=ep instead (bsc#1171569)\n","status":"published","published":"2021-06-11T10:56:48Z","modified":"2026-02-04T03:15:50.81708Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4981-1","title":"squid, squid3 vulnerabilities","description":"Joshua Rogers discovered that Squid incorrectly handled requests with the\nurn: scheme. A remote attacker could possibly use this issue to cause\nSquid to consume resources, leading to a denial of service.\n(CVE-2021-28651)\n\nJoshua Rogers discovered that Squid incorrectly handled requests to the\nCache Manager API. A remote attacker with access privileges could possibly\nuse this issue to cause Squid to consume resources, leading to a denial of\nservice. This issue was only addressed in Ubuntu 20.04 LTS, Ubuntu 20.10,\nand Ubuntu 21.04. (CVE-2021-28652)\n\nJoshua Rogers discovered that Squid incorrectly handled certain response\nheaders. A remote attacker could possibly use this issue to cause Squid to\ncrash, resulting in a denial of service. This issue was only affected\nUbuntu 20.04 LTS, Ubuntu 20.10, and Ubuntu 21.04. (CVE-2021-28662)\n\nJoshua Rogers discovered that Squid incorrectly handled range request\nprocessing. A remote attacker could possibly use this issue to cause Squid\nto crash, resulting in a denial of service. (CVE-2021-31806,\nCVE-2021-31807, CVE-2021-31808)\n\nJoshua Rogers discovered that Squid incorrectly handled certain HTTP\nresponses. A remote attacker could possibly use this issue to cause Squid\nto crash, resulting in a denial of service. (CVE-2021-33620)\n","status":"published","published":"2021-06-03T16:24:27Z","modified":"2026-04-27T19:02:52.083325532Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}