Back to Database
Status published
High
CVE-2016-4553
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does...
Vulnerability Description
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-4553
Credits & Attribution
No credits recorded in the NVD database.
References
- https://security.gentoo.org/glsa/201607-01
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://bugs.squid-cache.org/show_bug.cgi?id=4501
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
- http://www.squid-cache.org/Advisories/SQUID-2016_7.txt
- http://www.ubuntu.com/usn/USN-2995-1
- http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch
- https://access.redhat.com/errata/RHSA-2016:1140
- http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
- https://access.redhat.com/errata/RHSA-2016:1139
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
- http://www.securitytracker.com/id/1035768
- http://www.debian.org/security/2016/dsa-3625
More from canonical
View All →CVE-2025-31479
canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception output
High
8.2
CVE-2025-24375
MySQL K8s charm could leak credentials for root-level user `serverconfig`
Medium
5
CVE-2024-41129
The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
Medium
4.4
CVE-2020-8632
In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small...
Medium
5.5
CVE-2020-8631
cloud-init through 19.4 relies on Mersenne Twister for a random...
Medium
5.5
Affected Vendor
canonical
View all reports →Affected Software
ubuntu linux, squid, linux
Vulnerable Versions:
12.04, 14.04, 15.10, 16.04, 0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9, 7
Timeline
Official Publish:
May 10th, 2016
Last Modified:
August 6th, 2024
Added to House:
July 20th, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.