CVE-2009-2622

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 56.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-07-28 · updated 2026-06-16
Weakness: CWE-20

Description

Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.

Affected products

Squid: 3.0, 3.0-rc1, 3.0-rc4, 3.1, 3.1.0.1, 3.1.0.2 (+2)

References

http://secunia.com/advisories/36007
http://www.mandriva.com/security/advisories?name=MDVSA-2009:161
http://www.mandriva.com/security/advisories?name=MDVSA-2009:178
http://www.securityfocus.com/bid/35812
http://www.securitytracker.com/id?1022607
http://www.squid-cache.org/Advisories/SQUID-2009_2.txt
http://www.squid-cache.org/Versions/v3/3.1/changesets/b9661.patch
http://www.vupen.com/english/advisories/2009/2013
http://secunia.com/advisories/36007
http://www.mandriva.com/security/advisories?name=MDVSA-2009:161
http://www.mandriva.com/security/advisories?name=MDVSA-2009:178
http://www.securityfocus.com/bid/35812

Get alerted when CVE-2009-2622 or the next vulnerability affects your stack