VYPR
← All advisories
Unrated severityNVD Advisory· Published May 27, 2021· Updated Aug 3, 2024

CVE-2021-28652

CVE-2021-28652

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

25

Patches

Vulnerability mechanics

Root cause

"Incorrect parser validation in Cache Manager URI parsing causes a memory leak when processing a short query string."

Attack vector

A trusted client with Cache Manager API access privilege sends a specially crafted short query string to the Cache Manager endpoint. Due to incorrect parser validation, the request triggers a memory leak in the URI parsing code. Over time, repeated exploitation causes memory exhaustion, leading to a Denial of Service. The attack is limited to clients that already have Cache Manager API access privileges [ref_id=1].

Affected code

The vulnerability is in Squid's Cache Manager URI parsing code. The advisory lists "Memory Leak in CacheManager URI Parsing" as the affected code path [ref_id=1]. No specific function names or file paths are provided in the available references.

What the fix does

No patch or fix details are available in the provided references. The advisory notes that the issue was discovered during an independent audit and that no patches or workarounds have been published by the Squid Project for this vulnerability [ref_id=1]. The recommended remediation would be to upgrade to Squid version 4.15 or 5.0.6, as stated in the CVE description, but the specific code changes are not documented in the supplied bundle.

Preconditions

  • authAttacker must be a client with Cache Manager API access privilege
  • networkAttacker must be able to send HTTP requests to the Squid proxy's Cache Manager endpoint

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.