https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:31:17 +0000 https://cve.radiocsirt.org/vuln/bdu:2020-04148 bdu:2020-04148 https://cve.radiocsirt.org/vuln/bdu:2020-04148 https://cve.radiocsirt.org/vuln/certfr-2021-avi-700 certfr-2021-avi-700 https://cve.radiocsirt.org/vuln/certfr-2021-avi-700 https://cve.radiocsirt.org/vuln/cnvd-2020-50114 cnvd-2020-50114 https://cve.radiocsirt.org/vuln/cnvd-2020-50114 https://cve.radiocsirt.org/vuln/euvd-2026-43184 EUVD-2026-43184 https://cve.radiocsirt.org/vuln/euvd-2026-43184 https://cve.radiocsirt.org/vuln/fkie_cve-2020-15811 <p>An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.</p> <p>An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-15811 https://cve.radiocsirt.org/vuln/gsd-2020-15811 gsd-2020-15811 https://cve.radiocsirt.org/vuln/gsd-2020-15811 https://cve.radiocsirt.org/vuln/oesa-2021-1092 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: squid</p> <p>Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: squid</p> <p>Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fix(es): An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped to a valid error string.(CVE-2020-14058) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.(CVE-2020-15810) An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation…</p> https://cve.radiocsirt.org/vuln/oesa-2021-1092 https://cve.radiocsirt.org/vuln/opensuse-su-2020:1346-1 <p>Security update for squid</p> <p>Security update for squid</p> https://cve.radiocsirt.org/vuln/opensuse-su-2020:1346-1 https://cve.radiocsirt.org/vuln/suse-su-2020:14590-1 <p>Security update for squid3</p> <p>Security update for squid3</p> https://cve.radiocsirt.org/vuln/suse-su-2020:14590-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15811 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: squid3, Ubuntu:18.04:LTS: squid3, Ubuntu:20.04:LTS: squid</p> <p>An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: squid3, Ubuntu:18.04:LTS: squid3, Ubuntu:20.04:LTS: squid</p> <p>An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-15811 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2470 <p>Ein entfernter, anonymer oder authentiiserter Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder Sicherheitsmechanismen zu umgehen.</p> <p>Ein entfernter, anonymer oder authentiiserter Angreifer kann mehrere Schwachstellen in Squid ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren oder Sicherheitsmechanismen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2470