UpHeron
All vulnerabilities

Servers and applications

CVE-2020-15811

SQUID-2020:8 HTTP(S) Request Splitting

Severity
Medium 6.5
Published
23 Aug 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
4.13, 5.0.4
Also known as
GHSA-c7p8-xqhm-49wv
Sources
NVD, Project advisories (GitHub)

Description

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string…

Affected software

SoftwareAffected versions
SquidServers and applications · cpe:a:squid-cache:squid
  • Every version before 4.13
  • From 5.0 before 5.0.4
SquidServers and applications · github:squid-cache/squid
  • From 5.0.1 before 5.0.4

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-15811
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-15811
  • GitHub Advisory Database https://github.com/advisories/GHSA-c7p8-xqhm-49wv
  • github.com https://github.com/squid-cache/squid/security/advisories/GHSA-c7p8-xqhm-49wv