https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T23:27:35.229162+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2020:4743 ALSA-2020:4743 — Moderate: squid:4 security, bug fix, and enhancement update 2026-10-03T23:27:35.403172+00:00

Affected: AlmaLinux:8: libecap, AlmaLinux:8: libecap-devel

Squid is a high-performance proxy caching server for web clients, supporting FTP, Gopher, and HTTP data objects.

The following packages have been upgraded to a later upstream version: squid (4.11). (BZ#1829467)

Security Fix(es):

* squid: Improper input validation in request allows for proxy manipulation (CVE-2019-12520)

* squid: Off-by-one error in addStackElement allows for heap buffer overflow and crash (CVE-2019-12521)

* squid: Improper input validation in URI processor (CVE-2019-12523)

* squid: Improper access restriction in url_regex may lead to security bypass (CVE-2019-12524)

* squid: Heap overflow issue in URN processing (CVE-2019-12526)

* squid: Information Disclosure issue in FTP Gateway (CVE-2019-12528)

* squid: Out of bounds read in Proxy-Authorization header causes DoS (CVE-2019-12529)

* squid: Denial of service in cachemgr.cgi (CVE-2019-12854)

* squid: Buffer overflow in URI processor (CVE-2019-18676)

* squid: Cross-Site Request Forgery issue in HTTP Request processing (CVE-2019-18677)

* squid: HTTP Request Splitting issue in HTTP message processing (CVE-2019-18678)

* squid: Information Disclosure issue in HTTP Digest Authentication (CVE-2019-18679)

* squid: Mishandled HTML in the host parameter to cachemgr.cgi results in insecure behaviour (CVE-2019-18860)

* squid: Improper input validation issues in HTTP Request processing (CVE-2020-8449)

* squid: Buffer overflow in reverse-proxy configurations (CVE-2020-8450)

* squid: DoS in TLS handshake (…

 https://cve.radiocsirt.org/vuln/bdu:2020-04037 bdu:2020-04037 2026-10-03T23:27:35.403287+00:00 bdu:2020-04037 https://cve.radiocsirt.org/vuln/certfr-2020-avi-393 certfr-2020-avi-393 — Une vulnérabilité a été découverte dans Squid. Elle permet à un attaquant de provoquer un contournement de la politique… 2026-10-03T23:27:35.403309+00:00 certfr-2020-avi-393 https://cve.radiocsirt.org/vuln/cnvd-2021-36605 cnvd-2021-36605 2026-10-03T23:27:35.403325+00:00 cnvd-2021-36605 https://cve.radiocsirt.org/vuln/euvd-2026-42597 EUVD-2026-42597 2026-10-03T23:27:35.403338+00:00 EUVD-2026-42597 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15049 fkie_cve-2020-15049 2026-10-03T23:27:35.403349+00:00

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.

 https://cve.radiocsirt.org/vuln/gsd-2020-15049 gsd-2020-15049 2026-10-03T23:27:35.403373+00:00 gsd-2020-15049 https://cve.radiocsirt.org/vuln/oesa-2021-1092 OESA-2021-1092 — squid security update 2026-10-03T23:27:35.403384+00:00

Affected: openEuler:20.03-LTS-SP1: squid

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation…

 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1346-1 openSUSE-SU-2020:1346-1 — Security update for squid 2026-10-03T23:27:35.403422+00:00

Security update for squid

 https://cve.radiocsirt.org/vuln/suse-su-2020:14460-1 SUSE-SU-2020:14460-1 — Security update for squid3 2026-10-03T23:27:35.403443+00:00

Security update for squid3

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15049 UBUNTU-CVE-2020-15049 2026-10-03T23:27:35.403471+00:00

Affected: Ubuntu:16.04:LTS: squid3, Ubuntu:18.04:LTS: squid3, Ubuntu:20.04:LTS: squid

An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value.