Description
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | squid | 2.7.STABLE9-5 | — |
| Debian 13 | squid | 2.7.STABLE9-5 | — |
| Debian 12 | squid | 2.7.STABLE9-5 | — |
| Debian 7 | squid | 2.7.STABLE9-4.1+deb7u1 | DSA-3139-1 |
| Debian 7 | squid3 | 3.1.20-2.2+deb7u2 | DSA-3014-1 |
| Debian 6.0 | squid | 2.7.STABLE9-2.1+deb6u1 | DLA-216-1 |
| Debian 6.0 | squid3 | 3.1.6-1.2+squeeze4 | DLA-45-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | squid3 | 3.3.8-1ubuntu6.1 | USN-2327-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | squid +1 | 7:3.3.8-12.el7_0 | RHSA-2014:1147 |
| RHEL 6 | squid | 7:3.1.10-22.el6_5 | RHSA-2014:1148 |
| RHEL 5 | squid | 7:2.6.STABLE21-7.el5_10 | RHSA-2014:1148 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | squid +1 | 7:3.3.8-12.el7_0 | ELSA-2014-1147 |
Advisories 8
- RHSA-2014:1148 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:1147 Red Hat Security Advisory: squid security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DLA-45-1 squid3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3014-1 squid3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-216-1 squid - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3139-1 squid - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2327-1 squid3 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- ELSA-2014-1147 Important: squid security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 3, 2014
References
- 61320 third-party-advisory
- 60179 third-party-advisory
- SUSE-SU-2014:1140 vendor-advisory
- USN-2327-1 vendor-advisory
- DSA-3139 vendor-advisory
- openSUSE-SU-2014:1144 vendor-advisory
- DSA-3014 vendor-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html
- http://www.squid-cache.org/Advisories/SQUID-2014_2.txt
- RHSA-2014:1147 vendor-advisory
- 60334 third-party-advisory
- 69453 vdb-entry
- http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9201.patch
- 61412 third-party-advisory