CVE-2021-31806

MEDIUM 6.5CVE-2021-31806 · Published 27/05/2021 · updated 17/06/2026

In short

CVE-2021-31806 is a MEDIUM (CVSS 6.5) vulnerability affecting squid (squid-cache).
Chance of exploitation in the next 30 days (EPSS): 95.3%, higher than 99.9% of all vulnerabilities.
Fix: update to 5.0.6, 4.15 or later.

Package	Affected versions	Patched versions
squid squid-cache	`≥ 5.0, < 5.0.6< 4.15`	`5.0.64.15`

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.

References

seclists.org/fulldisclosure/2023/Oct/14 · Mailing List
openwall.com/lists/oss-security/2023/10/11/3 · Mailing List
squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch · Patch
squid-cache/squid security advisory · Patch
lists.debian.org/debian-lts-announce/2021/06/msg00014.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66
security.netapp.com/advisory/ntap-20210716-0007 · Third Party Advisory
debian.org/security/2021/dsa-4924 · Third Party Advisory

More vulnerabilities in squid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free