CVE-2020-25097

HIGH

Squid 2.0-4.13 and 5.0-5.0.4 - HTTP Request Smuggling via uri_whitespace Configuration

Title source: llm
STIX 2.1

Description

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

References (9)

Core 9
Core References
Mailing List, Patch, Vendor Advisory x_refsource_misc
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_11.patch
Mailing List, Patch, Vendor Advisory x_refsource_misc
http://www.squid-cache.org/Versions/v5/changesets/SQUID-2020_11.patch
Third Party Advisory vendor-advisory x_refsource_debian
https://www.debian.org/security/2021/dsa-4873
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202105-14
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20210727-0010/

Scores

CVSS v3 8.6
EPSS 0.0816
EPSS Percentile 94.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Details

CWE
CWE-444 CWE-20
Status published
Products (6)
debian/debian_linux 10.0
fedoraproject/fedora 32
fedoraproject/fedora 33
fedoraproject/fedora 34
netapp/cloud_manager
squid-cache/squid 2.0 - 4.14
Published Mar 19, 2021
Tracked Since Feb 18, 2026