Description
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.6.17-1 | — |
| Debian 13 | squid | 2.6.17-1 | — |
| Debian 12 | squid | 2.6.17-1 | — |
| Debian 4.0 | squid | 2.6.5-6etch1 | DSA-1646-2, DSA-1482-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | squid | 7:2.6.STABLE6-5.el5_1.2 | RHSA-2007:1130 |
| RHEL 4 | squid | 7:2.5.STABLE14-1.4E.el4_6.1 | RHSA-2007:1130 |
| RHEL 3 | squid | 7:2.5.STABLE3-8.3E | RHSA-2007:1130 |
| RHEL 2 | squid | 7:2.4.STABLE7-1.21as.11 | RHSA-2007:1130 |
Advisories 3
- RHSA-2007:1130 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1646-2 squid - array bounds check Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-1482-1 squid - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- 28091 third-party-advisory
- 28412 third-party-advisory
- FEDORA-2007-4161 vendor-advisory
- DSA-1482 vendor-advisory
- 28814 third-party-advisory
- VU#232881 third-party-advisory
- GLSA-200903-38 vendor-advisory
- 26687 vdb-entry
- RHSA-2007:1130 vendor-advisory
- 28109 third-party-advisory
- http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
- MDVSA-2008:002 vendor-advisory
- oval:org.mitre.oval:def:10915 vdb-entry signature
- 28403 third-party-advisory
- 27910 third-party-advisory
- GLSA-200801-05 vendor-advisory
- ADV-2007-4066 vdb-entry
- 28350 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=410181
- 1019036 vdb-entry
- 28381 third-party-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=201209
- 34467 third-party-advisory
- FEDORA-2007-4170 vendor-advisory
- USN-565-1 vendor-advisory
- http://www.squid-cache.org/Versions/v2/2.6/changesets/11780.patch
- SUSE-SR:2008:001 vendor-advisory