CVEvulnerability

CVE-2016-2570

7.5 HIGH Published 2016-02-27 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-02-27
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:N/A:P
Weaknesses
CWE-20

Description

The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.

Affected configurations

• squid-cache squid 3.0 • squid-cache squid 3.0.stable1 • squid-cache squid 3.0.stable2 • squid-cache squid 3.0.stable3 • squid-cache squid 3.0.stable4 • squid-cache squid 3.0.stable5 • squid-cache squid 3.0.stable6 • squid-cache squid 3.0.stable7 • squid-cache squid 3.0.stable8 • squid-cache squid 3.0.stable9 • squid-cache squid 3.0.stable10 • squid-cache squid 3.0.stable11 • squid-cache squid 3.0.stable12 • squid-cache squid 3.0.stable13 • squid-cache squid 3.0.stable14 • squid-cache squid 3.0.stable15 • squid-cache squid 3.0.stable16 • squid-cache squid 3.0.stable17 • squid-cache squid 3.0.stable18 • squid-cache squid 3.0.stable19 • squid-cache squid 3.0.stable20 • squid-cache squid 3.0.stable21 • squid-cache squid 3.0.stable22 • squid-cache squid 3.0.stable23 • squid-cache squid 3.0.stable24 • squid-cache squid 3.0.stable25 • squid-cache squid 3.1 • squid-cache squid 3.1.0.1 • squid-cache squid 3.1.0.2 • squid-cache squid 3.1.0.3 • squid-cache squid 3.1.0.4 • squid-cache squid 3.1.0.5 • squid-cache squid 3.1.0.6 • squid-cache squid 3.1.0.7 • squid-cache squid 3.1.0.8 • squid-cache squid 3.1.0.9 • squid-cache squid 3.1.0.10 • squid-cache squid 3.1.0.11 • squid-cache squid 3.1.0.12 • squid-cache squid 3.1.0.13 • squid-cache squid 3.1.0.14 • squid-cache squid 3.1.0.15 • squid-cache squid 3.1.0.16 • squid-cache squid 3.1.0.17 • squid-cache squid 3.1.0.18 • squid-cache squid 3.1.1 • squid-cache squid 3.1.2 • squid-cache squid 3.1.3 • squid-cache squid 3.1.4 • squid-cache squid 3.1.5 • squid-cache squid 3.1.5.1 • squid-cache squid 3.1.6 • squid-cache squid 3.1.7 • squid-cache squid 3.1.8 • squid-cache squid 3.1.9 • squid-cache squid 3.1.10 • squid-cache squid 3.1.11 • squid-cache squid 3.1.12 • squid-cache squid 3.1.13 • squid-cache squid 3.1.14 … and 73 more

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References