VYPR
← All advisories
Unrated severityNVD Advisory· Published May 28, 2021· Updated Aug 3, 2024

CVE-2021-33620

CVE-2021-33620

Description

Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

29

Patches

Vulnerability mechanics

Root cause

"Crash in Content-Range response header parsing logic allows a remote server to cause a denial of service."

Attack vector

A remote server sends an HTTP response containing a crafted Content-Range header to a Squid proxy. The Squid proxy processes this header in a way that triggers a crash, causing a denial of service that affects availability to all clients using that proxy instance [ref_id=1]. The advisory notes the trigger is a header that can be expected to exist in normal HTTP traffic without malicious intent by the server [ref_id=1].

Affected code

The advisory lists "Crash in Content-Range Response Header Logic CVE-2021-33620" as one of the 55 vulnerabilities found in the Squid security audit [ref_id=1]. No specific function names or file paths are provided in the reference.

What the fix does

The advisory does not include a patch or detailed remediation guidance. The Squid Project was made aware of the issues but after two and a half years the researcher released them publicly [ref_id=1]. The fix would require correcting the Content-Range response header parsing logic to properly validate and handle edge cases that currently cause a crash.

Preconditions

  • configThe Squid proxy must be configured to forward HTTP responses (default behavior).
  • networkA remote server (or an attacker controlling a server the client connects to) sends an HTTP response with a crafted Content-Range header.
  • authNo authentication or special privileges are required for the attacker; the malicious response is delivered during normal proxied traffic.

Generated on May 25, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

8

News mentions

0

No linked articles in our index yet.