CVE-2016-4553 PUBLISHED

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.

EPSS 82.84% · 99.2th percentile

Risk Scores

EPSS Score
82.84%
99.2th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSsquid30, 3.3.8-1ubuntu16, 3.3.8-1ubuntu17
Ubuntu:14.04:LTSsquid33.3.8-1ubuntu6.2, 3.3.8-1ubuntu6.3, 0

Timeline

References

Open in Interactive Console →