CVE-2016-2569: Input Validation
Published Feb 27, 2016
·Updated
Last updated 25 August 2025
Other sources
Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
— Launchpad
Affected Software
144 affected componentsFixes available
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0
Squid-Cache Squid=3.0-rc4
Squid-Cache Squid=3.0.stable1
Squid-Cache Squid=3.0.stable2
Squid-Cache Squid=3.0.stable3
Squid-Cache Squid=3.0.stable4
Squid-Cache Squid=3.0.stable5
Squid-Cache Squid=3.0.stable6
Squid-Cache Squid=3.0.stable7
Squid-Cache Squid=3.0.stable8
Squid-Cache Squid=3.0.stable9
Squid-Cache Squid=3.0.stable10
Squid-Cache Squid=3.0.stable11
Squid-Cache Squid=3.0.stable11-rc1
Squid-Cache Squid=3.0.stable12
Squid-Cache Squid=3.0.stable13
Squid-Cache Squid=3.0.stable14
Squid-Cache Squid=3.0.stable15
Squid-Cache Squid=3.0.stable16
Squid-Cache Squid=3.0.stable16-rc1
Squid-Cache Squid=3.0.stable17
Squid-Cache Squid=3.0.stable18
Squid-Cache Squid=3.0.stable19
Squid-Cache Squid=3.0.stable20
Squid-Cache Squid=3.0.stable21
Squid-Cache Squid=3.0.stable22
Squid-Cache Squid=3.0.stable23
Squid-Cache Squid=3.0.stable24
Squid-Cache Squid=3.0.stable25
Squid-Cache Squid=3.1
Squid-Cache Squid=3.1.0.1
Squid-Cache Squid=3.1.0.2
Squid-Cache Squid=3.1.0.3
Squid-Cache Squid=3.1.0.4
Squid-Cache Squid=3.1.0.5
Squid-Cache Squid=3.1.0.6
Squid-Cache Squid=3.1.0.7
Squid-Cache Squid=3.1.0.8
Squid-Cache Squid=3.1.0.9
Squid-Cache Squid=3.1.0.10
Squid-Cache Squid=3.1.0.11
Squid-Cache Squid=3.1.0.12
Squid-Cache Squid=3.1.0.13
Squid-Cache Squid=3.1.0.14
Squid-Cache Squid=3.1.0.15
Squid-Cache Squid=3.1.0.16
Squid-Cache Squid=3.1.0.17
Squid-Cache Squid=3.1.0.18
Squid-Cache Squid=3.1.1
Squid-Cache Squid=3.1.2
Squid-Cache Squid=3.1.3
Squid-Cache Squid=3.1.4
Squid-Cache Squid=3.1.5
Squid-Cache Squid=3.1.5.1
Squid-Cache Squid=3.1.6
Squid-Cache Squid=3.1.7
Squid-Cache Squid=3.1.8
Squid-Cache Squid=3.1.9
Squid-Cache Squid=3.1.10
Squid-Cache Squid=3.1.11
Squid-Cache Squid=3.1.12
Squid-Cache Squid=3.1.13
Squid-Cache Squid=3.1.14
Squid-Cache Squid=3.1.15
Squid-Cache Squid=3.2.0.1
Squid-Cache Squid=3.2.0.2
Squid-Cache Squid=3.2.0.3
Squid-Cache Squid=3.2.0.4
Squid-Cache Squid=3.2.0.5
Squid-Cache Squid=3.2.0.6
Squid-Cache Squid=3.2.0.7
Squid-Cache Squid=3.2.0.8
Squid-Cache Squid=3.2.0.9
Squid-Cache Squid=3.2.0.10
Squid-Cache Squid=3.2.0.11
Squid-Cache Squid=3.2.0.12
Squid-Cache Squid=3.2.0.13
Squid-Cache Squid=3.2.0.14
Squid-Cache Squid=3.2.0.15
Squid-Cache Squid=3.2.0.16
Squid-Cache Squid=3.2.0.17
Squid-Cache Squid=3.2.0.18
Squid-Cache Squid=3.2.0.19
Squid-Cache Squid=3.2.1
Squid-Cache Squid=3.2.2
Squid-Cache Squid=3.2.3
Squid-Cache Squid=3.2.4
Squid-Cache Squid=3.2.5
Squid-Cache Squid=3.2.6
Squid-Cache Squid=3.2.7
Squid-Cache Squid=3.2.8
Squid-Cache Squid=3.2.9
Squid-Cache Squid=3.2.10
Squid-Cache Squid=3.2.11
Squid-Cache Squid=3.2.12
Squid-Cache Squid=3.2.13
Squid-Cache Squid=3.3.0
Squid-Cache Squid=3.3.0.2
Squid-Cache Squid=3.3.0.3
Squid-Cache Squid=3.3.1
Squid-Cache Squid=3.3.2
Squid-Cache Squid=3.3.3
Squid-Cache Squid=3.3.4
Squid-Cache Squid=3.3.5
Squid-Cache Squid=3.3.6
Squid-Cache Squid=3.3.7
Squid-Cache Squid=3.3.8
Squid-Cache Squid=3.3.9
Squid-Cache Squid=3.3.10
Squid-Cache Squid=3.3.11
Squid-Cache Squid=3.3.12
Squid-Cache Squid=3.3.13
Squid-Cache Squid=3.4.0.1
Squid-Cache Squid=3.4.0.2
Squid-Cache Squid=3.4.0.3
Squid-Cache Squid=3.4.1
Squid-Cache Squid=3.4.2
Squid-Cache Squid=3.4.3
Squid-Cache Squid=3.4.4
Squid-Cache Squid=3.4.8
Squid-Cache Squid=3.4.9
Squid-Cache Squid=3.4.10
Squid-Cache Squid=3.4.11
Squid-Cache Squid=3.4.12
Squid-Cache Squid=3.4.13
Squid-Cache Squid=3.5.0.1
Squid-Cache Squid=3.5.0.2
Squid-Cache Squid=3.5.0.3
Squid-Cache Squid=3.5.0.4
Squid-Cache Squid=3.5.1
Squid-Cache Squid=4.0.1
Squid-Cache Squid=4.0.2
Squid-Cache Squid=4.0.3
Squid-Cache Squid=4.0.4
Squid-Cache Squid=4.0.5
Squid-Cache Squid=4.0.6
debian/squid
4.13-10+deb11u34.13-10+deb11u65.7-2+deb12u55.7-2+deb12u46.13-2+deb13u17.4-1
Remediation
Event History
Feb 27, 2016
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Data Sourced
via NVD·05:59 AM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:16 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·04:46 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·04:46 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2016-2569?
The severity of CVE-2016-2569 is classified as high due to its potential to cause denial of service.
2
How do I fix CVE-2016-2569?
To fix CVE-2016-2569, upgrade to Squid version 3.5.15 or later for the 3.x branch, or version 4.0.7 or later for the 4.x branch.
3
What are the implications of exploiting CVE-2016-2569?
Exploiting CVE-2016-2569 can lead to an assertion failure and cause the Squid daemon to exit unexpectedly.
4
Which versions of Squid are affected by CVE-2016-2569?
CVE-2016-2569 affects Squid versions prior to 3.5.15 in the 3.x branch and prior to 4.0.7 in the 4.x branch.
5
Is the CVE-2016-2569 vulnerability remote or local?
CVE-2016-2569 is a remote vulnerability that allows attackers to send specially crafted HTTP headers to exploit the flaw.