Medium severity6.5NVD Advisory· Published Sep 2, 2020· Updated Jun 17, 2026
CVE-2020-15810
CVE-2020-15810
Description
An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
43- osv-coords30 versionspkg:rpm/opensuse/squid&distro=openSUSE%20Tumbleweedpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/squid&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/squid3&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP5pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%207pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-LTSSpkg:rpm/suse/squid&distro=SUSE%20Enterprise%20Storage%205pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/squid&distro=openSUSE%20Leap%2015.1pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/squid&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP1pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015-ESPOSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2015-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3-BCLpkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Point%20of%20Sale%2011%20SP3pkg:rpm/suse/squid&distro=SUSE%20Linux%20Enterprise%20Server%2011%20SP4-LTSS
< 4.16-1.5+ 29 more
- (no CPE)range: < 4.16-1.5
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.1.23-8.16.37.15.1
- (no CPE)range: < 3.1.23-8.16.37.15.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 4.13-4.15.1
- (no CPE)range: < 4.13-4.15.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 4.13-lp152.2.6.1
- (no CPE)range: < 4.13-lp151.2.24.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 4.13-5.23.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 3.5.21-26.32.1
- (no CPE)range: < 2.7.STABLE5-2.12.30.6.1
- (no CPE)range: < 2.7.STABLE5-2.12.30.6.1
- Squid/Squiddescription
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
13- lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.htmlnvdMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.htmlnvdMailing ListThird Party Advisory
- github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98mnvdMitigationThird Party Advisory
- lists.debian.org/debian-lts-announce/2020/10/msg00005.htmlnvdMailing ListThird Party Advisory
- security.netapp.com/advisory/ntap-20210219-0007/nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20210226-0006/nvdThird Party Advisory
- usn.ubuntu.com/4477-1/nvdThird Party Advisory
- usn.ubuntu.com/4551-1/nvdThird Party Advisory
- www.debian.org/security/2020/dsa-4751nvdThird Party Advisory
- security.netapp.com/advisory/ntap-20210226-0007/nvdBroken Link
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/nvd
News mentions
0No linked articles in our index yet.