This vulnerability allows remote attackers to deny service on vulnerable installations of The Squid Software Foundation Squid 3.5.27-20180318. Authentication is not required to exploit this vulnerability. The specific flaw exists within ClientRequestContext::sslBumpAccessCheck(). A crafted request can trigger the dereference of a null pointer. An attacker can leverage this vulnerability to create a denial-of-service condition to users of the system. Was ZDI-CAN-6088.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade squid | Aug 22, 2024 | May 16, 2018 |
| Amazon Linux Ami 2 | — | Upgrade squid-debuginfoUpgrade squid-migration-scriptUpgrade squid-sysvinitUpgrade squid | Sep 3, 2020 | May 16, 2018 |
| Debian | — | Upgrade squid | Jul 30, 2024 | May 16, 2018 |
| Oracle Solaris | — | Upgrade web/proxy/squid to version 4.8-11.4.15.0.1.3.0 on Solaris 11.4 | Nov 20, 2019 | May 16, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 16, 2018 |
| Suse | — | Upgrade squidUpgrade squid3 | May 3, 2018 | May 2, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub