CVE-2019-12526

CVE-2019-12526 affects Squid prior to 4.9, where URN response handling can overflow the heap with attacker-controlled data when processing URN responses from a remote server. The connected advisories confirm that a fix is available in newer upstream versions (e.g., 4.10+ as reflected in ALT Linux...

CVE-2019-12523

CVE-2019-12523 affects Squid prior to 4.9, where handling a URN request transforms it into an HTTP request that bypasses the standard incoming HTTP access checks. This allows an attacker to access restricted HTTP servers (e.g., localhost) by bypassing ACLs via the URN path, with potential exposur...

CVE-2019-18678

CVE-2019-18678 affects Squid 3.x and 4.x up to 4.8. It arises from a request header with whitespace between a header name and a colon, enabling an attacker to smuggle HTTP requests through frontend software to a Squid instance. The resulting Response messages corrupt caches between the client and...

CVE-2019-18679

The CVE-2019-18679 issue affects Squid 2.x–4.x (through 4.8) and arises from incorrect data management during HTTP Digest Authentication, where nonce tokens contain the raw pointer byte value from heap memory. This information disclosure reduces ASLR effectiveness and could assist attackers targe...

CVE-2019-18676

CVE-2019-18676 affects Squid 3.x and 4.x up to 4.8, where incorrect input validation enables a heap-based buffer overflow that can cause a Denial of Service to all clients using the proxy. The connected advisories describe the issue scope and related CVEs in the same Squid codebase (URn/URI proce...

CVE-2019-18677

CVE-2019-18677 affects Squid 3.x and 4.x up to 4.8 where the append_domain setting can cause improper message processing, leading to traffic being redirected to origins that should not be delivered to. This is confirmed in multiple advisories (e.g., ALAS2-2023-2318) listing CVE-2019-18677 as a se...