Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause…
Priority MEDIUM 56CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
Why it matters now
EPSS 0.56908 99th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 29
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:squid-cache:squid:3.0:*:pre1:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre2:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre3:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre4:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre5:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre6:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:pre7:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable1:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable10:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable11:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
- cpe:2.3:a:squid-cache:squid:3.0:*:pre1:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre2:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre3:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre4:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre5:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre6:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:pre7:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable1:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable10:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable11:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
Show 19 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:squid-cache:squid:3.0:*:stable12:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable13:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable14:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable15:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable2:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable3:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable4:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable5:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable6:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable7:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable8:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:*:stable9:*:*:*:*:* | 3.0 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:rc1:stable11:*:*:*:*:* | 3.0 rc1 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:* | 3.0 rc4 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:* | 3.1 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:* | 3.1.0.1 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:* | 3.1.0.2 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:* | 3.1.0.3 | Vulnerable | squid-cache |
| cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:* | 3.1.0.4 | Vulnerable | squid-cache |
- cpe:2.3:a:squid-cache:squid:3.0:*:stable12:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable13:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable14:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable15:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable2:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable3:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable4:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable5:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable6:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable7:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable8:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:*:stable9:*:*:*:*:* Versions 3.0 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:rc1:stable11:*:*:*:*:* Versions 3.0 rc1 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:* Versions 3.0 rc4 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:* Versions 3.1.0.1 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:* Versions 3.1.0.2 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:* Versions 3.1.0.3 Vulnerable ·squid-cache
- cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:* Versions 3.1.0.4 Vulnerable ·squid-cache
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2009-2622
- 2026-10-03 Alias added: GHSA-ww59-3r9r-8fph
References
More squid-cache Squid vulnerabilities
- TI-2025-38486 Squid vulnerable to information disclosure via authentication credential leakage in error handling CVSS 3.1CRITICAL 10.0
- TI-2024-16845 Denial of Service in HTTP Header parser in squid proxy CVSS 3.1HIGH 7.5
- TI-2024-16566 SQUID-2024:1 Denial of Service in HTTP Chunked Decoding CVSS 3.1HIGH 8.6
- TI-2023-26921 Denial of Service in HTTP Message Processing in Squid CVSS 3.1HIGH 8.6
- TI-2023-27496 SQUID-2023:10 Denial of Service in HTTP Request parsing CVSS 3.1HIGH 8.6
- TI-2023-25306 Squid: denial of service in http digest authentication CVSS 3.1HIGH 8.6
Sources
- CVE-2009-2622 · CVE Program
- CVE-2009-2622 · NVD
- FIRST EPSS
- GHSA-ww59-3r9r-8fph · GitHub Advisory Database · CC BY 4.0
- CVE-2009-2622 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences