VYPR
← All advisories
Unrated severityNVD Advisory· Published May 27, 2021· Updated Aug 3, 2024

CVE-2021-31806

CVE-2021-31806

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

25

Patches

Vulnerability mechanics

Root cause

"Memory-management bug in HTTP Range request processing leads to an assertion failure on unsatisfiable range requests."

Attack vector

An attacker sends HTTP requests with crafted Range headers that specify byte ranges which cannot be satisfied by the cached or requested content. The advisory classifies this as an "Unsatisfiable Range Requests Assertion" [ref_id=1]. Processing such a request triggers a memory-management bug that causes an assertion failure, crashing the Squid process and denying service to all clients using the proxy.

Affected code

The advisory lists "Unsatisfiable Range Requests Assertion CVE-2021-31806" as one of the discovered issues [ref_id=1]. No specific function or file paths are provided in the bundle.

What the fix does

The advisory states that Squid versions before 4.15 and 5.x before 5.0.6 are affected, implying the fix was applied in those releases. No patch diff is included in the bundle. The remediation guidance is to upgrade to Squid 4.15 or 5.0.6 or later, which corrects the memory-management bug in HTTP Range request processing that caused the assertion crash.

Preconditions

  • networkThe attacker must be able to send HTTP requests to the vulnerable Squid proxy.
  • inputThe Range header must specify byte ranges that cannot be satisfied by the proxy.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.