UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15810

SQUID-2020:10 HTTP(S) Request Smuggling

Severity
Medium 6.5
Published
23 Aug 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.13, 5.0.4
Also known as
GHSA-3365-q9qx-f98m
Sources
NVD, Project advisories (GitHub)

Description

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for…

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • Every version before 4.13
  • From 5.0 before 5.0.4
SquidServers and applications · github:squid-cache/squid
  • From 5.0.1 before 5.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15810
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15810
  • GitHub Advisory Database https://github.com/advisories/GHSA-3365-q9qx-f98m
  • github.com https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m