UpHeron
All vulnerabilities

Servers and applications

CVE-2016-2570

The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.

Severity
High 7.5
Published
27 Feb 2016
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
9% in the next 30 daysHigher than 95% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
Improper input validation (CWE-20)
Attack
Over the network · No login needed · No user action needed
Attacker can
Take it down
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Sources
NVD

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • Version 4.0.6
  • Version 4.0.5
  • Version 4.0.4
  • Version 4.0.3
All 136 release lines
  • Version 3.0-rc4
  • Version 3.0.stable11-rc1
  • Version 3.0.stable16-rc1
  • Version 3.0
  • Version 3.0.stable1
  • Version 3.0.stable2
  • Version 3.0.stable3
  • Version 3.0.stable4
  • Version 3.0.stable5
  • Version 3.0.stable6
  • Version 3.0.stable7
  • Version 3.0.stable8
  • Version 3.0.stable9
  • Version 3.0.stable10
  • Version 3.0.stable11
  • Version 3.0.stable12
  • Version 3.0.stable13
  • Version 3.0.stable14
  • Version 3.0.stable15
  • Version 3.0.stable16
  • Version 3.0.stable17
  • Version 3.0.stable18
  • Version 3.0.stable19
  • Version 3.0.stable20
  • Version 3.0.stable21
  • Version 3.0.stable22
  • Version 3.0.stable23
  • Version 3.0.stable24
  • Version 3.0.stable25
  • Version 3.1
  • Version 3.1.0.1
  • Version 3.1.0.2
  • Version 3.1.0.3
  • Version 3.1.0.4
  • Version 3.1.0.5
  • Version 3.1.0.6
  • Version 3.1.0.7
  • Version 3.1.0.8
  • Version 3.1.0.9
  • Version 3.1.0.10
  • Version 3.1.0.11
  • Version 3.1.0.12
  • Version 3.1.0.13
  • Version 3.1.0.14
  • Version 3.1.0.15
  • Version 3.1.0.16
  • Version 3.1.0.17
  • Version 3.1.0.18
  • Version 3.1.1
  • Version 3.1.2
  • Version 3.1.3
  • Version 3.1.4
  • Version 3.1.5
  • Version 3.1.5.1
  • Version 3.1.6
  • Version 3.1.7
  • Version 3.1.8
  • Version 3.1.9
  • Version 3.1.10
  • Version 3.1.11
  • Version 3.1.12
  • Version 3.1.13
  • Version 3.1.14
  • Version 3.1.15
  • Version 3.2.0.1
  • Version 3.2.0.2
  • Version 3.2.0.3
  • Version 3.2.0.4
  • Version 3.2.0.5
  • Version 3.2.0.6
  • Version 3.2.0.7
  • Version 3.2.0.8
  • Version 3.2.0.9
  • Version 3.2.0.10
  • Version 3.2.0.11
  • Version 3.2.0.12
  • Version 3.2.0.13
  • Version 3.2.0.14
  • Version 3.2.0.15
  • Version 3.2.0.16
  • Version 3.2.0.17
  • Version 3.2.0.18
  • Version 3.2.0.19
  • Version 3.2.1
  • Version 3.2.2
  • Version 3.2.3
  • Version 3.2.4
  • Version 3.2.5
  • Version 3.2.6
  • Version 3.2.7
  • Version 3.2.8
  • Version 3.2.9
  • Version 3.2.10
  • Version 3.2.11
  • Version 3.2.12
  • Version 3.2.13
  • Version 3.3.0
  • Version 3.3.0.2
  • Version 3.3.0.3
  • Version 3.3.1
  • Version 3.3.2
  • Version 3.3.3
  • Version 3.3.4
  • Version 3.3.5
  • Version 3.3.6
  • Version 3.3.7
  • Version 3.3.8
  • Version 3.3.9
  • Version 3.3.10
  • Version 3.3.11
  • Version 3.3.12
  • Version 3.3.13
  • Version 3.4.0.1
  • Version 3.4.0.2
  • Version 3.4.0.3
  • Version 3.4.1
  • Version 3.4.2
  • Version 3.4.3
  • Version 3.4.4
  • Version 3.4.8
  • Version 3.4.9
  • Version 3.4.10
  • Version 3.4.11
  • Version 3.4.12
  • Version 3.4.13
  • Version 3.5.0.1
  • Version 3.5.0.2
  • Version 3.5.0.3
  • Version 3.5.0.4
  • Version 3.5.1
  • Version 4.0.1
  • Version 4.0.2
  • Version 4.0.3
  • Version 4.0.4
  • Version 4.0.5
  • Version 4.0.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-2570
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-2570