CVE-2021-33620: Input Validation
Due to an input validation bug Squid is vulnerable to a Denial of Service against all clients using the proxy. This problem allows a remote server to perform Denial of Service when delivering HTTP Response messages. The issue trigger is a header which can be expected to exist in HTTP traffic without any malicious intent by the server.
Reference: https://github.com/squid-cache/squid/security/advisories/GHSA-572g-rvwr-6c7f/
Other sources
Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-33620?
CVE-2021-33620 is a vulnerability in Squid before 4.15 and 5.x before 5.0.6 that allows remote servers to cause a denial of service by sending a specific HTTP response.
How does CVE-2021-33620 affect the availability of clients?
CVE-2021-33620 affects the availability of clients by causing a denial of service, making the service unavailable to all clients.
What is the severity of CVE-2021-33620?
CVE-2021-33620 has a severity value of 6.5, which is considered medium.
Which software versions are affected by CVE-2021-33620?
Squid versions before 4.15 and 5.x before 5.0.6 are affected by CVE-2021-33620.
How can I fix CVE-2021-33620?
To fix CVE-2021-33620, update your Squid installation to version 4.15 or higher if using the 4.x branch, or version 5.0.6 or higher if using the 5.x branch.