CVE-2020-8449

HIGH 7.5CVE-2020-8449 · Published 04/02/2020 · updated 17/06/2026

In short

CVE-2020-8449 is a HIGH (CVSS 7.5) vulnerability affecting squid (squid-cache).
Chance of exploitation in the next 30 days (EPSS): 8.3%, higher than 94.9% of all vulnerabilities.
Fix: update to 4.10 or later.

Package	Affected versions	Patched versions
squid squid-cache	`< 4.10`	`4.10`

Description

An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters.

References

lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html · Mailing List
lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html · Mailing List
squid-cache.org/Advisories/SQUID-2020_1.txt · Patch
squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch · Patch
squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch · Patch
squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch · Patch
squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch · Patch
squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch · Patch
lists.debian.org/debian-lts-announce/2020/07/msg00009.html · Mailing List

More vulnerabilities in squid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free