Denial of Service Vulnerability in Squid Proxy by Squid Software
CVE-2021-31806

6.5MEDIUM

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
27 May 2021

What is CVE-2021-31806?

A memory-management bug in Squid Proxy versions before 4.15 and 5.x before 5.0.6 exposes the server to Denial of Service attacks. This vulnerability arises from improper processing of HTTP Range requests. When exploited, it affects all clients using the proxy, potentially leading to service interruption and degraded network performance. It is crucial for users of affected versions to apply patches or updates to mitigate the risk of exploitation.

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_MISC
http://www.squid-cache.org/Versions/v4/changesets/squid-4...
x_refsource_MISC
https://www.debian.org/security/2021/dsa-4924
vendor-advisoryx_refsource_DEBIAN

EPSS Score

67% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.