CVE-2005-0241

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 69.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2005-05-02 · updated 2026-06-16

Description

The httpProcessReplyHeader function in http.c for Squid 2.5-STABLE7 and earlier does not properly set the debug context when it is handling "oversized" HTTP reply headers, which might allow remote attackers to poison the cache or bypass access controls based on header size.

Affected products

Squid: 2.5.stable1, 2.5.stable2, 2.5.stable3, 2.5.stable4, 2.5.stable5, 2.5.stable6 (+1)

References

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000931
http://fedoranews.org/updates/FEDORA--.shtml
http://secunia.com/advisories/14091
http://www.kb.cert.org/vuls/id/823350
http://www.novell.com/linux/security/advisories/2005_06_squid.html
http://www.redhat.com/support/errata/RHSA-2005-060.html
http://www.redhat.com/support/errata/RHSA-2005-061.html
http://www.securityfocus.com/bid/12412
http://www.squid-cache.org/Versions/v2/2.5/bugs/#squid-2.5.STABLE7-oversize_reply_headers
http://www.squid-cache.org/Versions/v2/2.5/bugs/squid-2.5.STABLE7-oversize_reply_headers.patch
http://www.squid-cache.org/bugs/show_bug.cgi?id=1216
https://exchange.xforce.ibmcloud.com/vulnerabilities/19060

Get alerted when CVE-2005-0241 or the next vulnerability affects your stack