VYPR
← All advisories
Unrated severityNVD Advisory· Published May 27, 2021· Updated Aug 3, 2024

CVE-2021-28662

CVE-2021-28662

Description

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

25

Patches

Vulnerability mechanics

Root cause

"Missing input validation on a Vary response header causes an assertion crash in Squid's HTTP response handling."

Attack vector

A remote attacker sends a crafted HTTP response containing a certain header (the "Vary" header is implicated by the advisory's description) to a Squid proxy. When Squid processes this response, the malformed header triggers an assertion failure, causing the proxy process to crash. The attack can be carried out over HTTP or HTTPS, and the advisory notes that such a header "can plausibly occur in benign network traffic," meaning the crash may be triggered without intentionally malicious payloads [ref_id=1].

Affected code

The advisory lists "Vary: Other HTTP Response Assertion Crash CVE-2021-28662" among the discovered issues [ref_id=1]. No specific source files or function names are provided in the reference write-up.

What the fix does

The advisory states that the issue was fixed in Squid 4.15 and 5.0.6 [ref_id=1]. No patch diff is included in the bundle, so the specific code changes are not available. The fix likely adds proper validation of the Vary response header to prevent the assertion failure.

Preconditions

  • configThe Squid proxy must be running a vulnerable version (4.x before 4.15 or 5.x before 5.0.6).
  • networkThe attacker must be able to cause the Squid proxy to receive a crafted HTTP response with a certain Vary header.
  • authNo authentication is required; the attack can be triggered by benign-looking network traffic.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.