VYPR
← All advisories
Unrated severityNVD Advisory· Published May 27, 2021· Updated Aug 3, 2024

CVE-2021-28651

CVE-2021-28651

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

33

Patches

Vulnerability mechanics

Root cause

"Buffer-management bug in URN response parsing causes a memory leak."

Attack vector

An attacker sends a request using the urn: scheme to a vulnerable Squid proxy. When Squid resolves the request, a buffer-management bug in the URN response parser causes a small memory leak per request [ref_id=1]. While each individual leak is small, the advisory notes that an unspecified attack methodology can easily trigger a large amount of memory consumption, leading to denial of service [ref_id=1].

Affected code

The vulnerability is in Squid's handling of RFC 2141 / 2169 (URN) response parsing. The advisory lists it as "RFC 2141 / 2169 (URN) Response Parsing Memory Leak CVE-2021-28651" [ref_id=1]. The exact function names and file paths are not specified in the available reference.

What the fix does

The advisory does not include a patch or specific remediation details. Squid versions before 4.15 and 5.x before 5.0.6 are affected [ref_id=1]. The advisory states that the majority of the 55 discovered vulnerabilities (including this one) remain unfixed, with no patches or workarounds available [ref_id=1].

Preconditions

  • networkThe attacker must be able to send requests to a vulnerable Squid proxy (version before 4.15 or 5.x before 5.0.6).
  • inputThe request must use the urn: scheme to trigger the vulnerable code path.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.