Servers and applications
CVE-2015-3455 Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.
Severity Low 2.6
Published 18 May 2015
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 11% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST , 11 Nov 2026
Attack Over the network · Only under certain conditions · No login needed
Attacker can Change some data
CVSS vector AV:N/AC:H/Au:N/C:N/I:P/A:N
Sources NVD Affected software Software Affected versions SquidServers and applications · cpe:a:squid-cache:squid Version 3.5.2 Version 3.5.1 Version 3.5.0.4 Version 3.5.0.3 All 70 release lines Version 3.2.0.1 Version 3.2.0.2 Version 3.2.0.3 Version 3.2.0.4 Version 3.2.0.5 Version 3.2.0.6 Version 3.2.0.7 Version 3.2.0.8 Version 3.2.0.9 Version 3.2.0.10 Version 3.2.0.11 Version 3.2.0.12 Version 3.2.0.13 Version 3.2.0.14 Version 3.2.0.15 Version 3.2.0.16 Version 3.2.0.17 Version 3.2.0.18 Version 3.2.0.19 Version 3.2.1 Version 3.2.2 Version 3.2.3 Version 3.2.4 Version 3.2.5 Version 3.2.6 Version 3.2.7 Version 3.2.8 Version 3.2.9 Version 3.2.10 Version 3.2.11 Version 3.2.12 Version 3.2.13 Version 3.3.0 Version 3.3.0.1 Version 3.3.0.2 Version 3.3.0.3 Version 3.3.1 Version 3.3.2 Version 3.3.3 Version 3.3.4 Version 3.3.5 Version 3.3.6 Version 3.3.7 Version 3.3.8 Version 3.3.9 Version 3.3.10 Version 3.3.11 Version 3.3.12 Version 3.3.13 Version 3.4.0.1 Version 3.4.0.2 Version 3.4.0.3 Version 3.4.1 Version 3.4.2 Version 3.4.3 Version 3.4.4 Version 3.4.5 Version 3.4.6 Version 3.4.7 Version 3.4.8 Version 3.4.9 Version 3.4.10 Version 3.4.11 Version 3.4.12 Version 3.5.0.1 Version 3.5.0.2 Version 3.5.0.3 Version 3.5.0.4 Version 3.5.1 Version 3.5.2
References NVD https://nvd.nist.gov/vuln/detail/CVE-2015-3455 CVE.org https://www.cve.org/CVERecord?id=CVE-2015-3455