CVE-2020-8450

Severity: high (CVSS 7.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 71.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-02-04 · updated 2026-06-17
Weakness: CWE-131

Description

An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 19.10
Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 30, 31
openSUSE Leap: 15.1
Squid: before 4.10 — fixed in 4.10

How to fix

Upgrade to a fixed version: Squid 4.10. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00012.html
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00010.html
http://www.squid-cache.org/Advisories/SQUID-2020_1.txt
http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2020_1.patch
http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-8e657e835965c3a011375feaa0359921c5b3e2dd.patch
http://www.squid-cache.org/Versions/v4/changesets/SQUID-2020_1.patch
http://www.squid-cache.org/Versions/v4/changesets/squid-4-b3a0719affab099c684f1cd62b79ab02816fa962.patch
http://www.squid-cache.org/Versions/v4/changesets/squid-4-d8e4715992d0e530871519549add5519cbac0598.patch
https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G6W2IQ7QV2OGREFFUBNVZIDD3RJBDE4R/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TSU6SPANL27AGK5PCGBJOKG4LUWA555J/
https://security.gentoo.org/glsa/202003-34

Get alerted when CVE-2020-8450 or the next vulnerability affects your stack