5

CVE-2009-0478: squid Improper Input Validation

CVSS: 5.0v2.0MediumModified
AliasesDEBIAN-CVE-2009-0478DSA-1732-1
Published 08-02-2009Last modified 07-08-2024
Open JSON

Vulnerability summary

CVE-2009-0478 is a medium (CVSS 5.0) Improper Input Validation vulnerability in squid. EPSS estimates a 71.99% chance of exploitation in the next 30 days, higher than 99.4% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
44/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.0/10
010
Medium · v2.0 (NVD)
EPSS score
71.99%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, exploit-database

Timeline

  1. 08-02-2009
    PublishedVulnerability first disclosed.
  2. 07-08-2024
    Last modifiedVulnerability information updated.

Description

Squid 2.7 to 2.7.STABLE5, 3.0 to 3.0.STABLE12, and 3.1 to 3.1.0.4 allows remote attackers to cause a denial of service via an HTTP request with an invalid version number, which triggers a reachable assertion in (1) HttpMsg.c and (2) HttpStatusLine.c.

CVSS metrics

1 score · 1 source · 1 version

EPSS trend

Probability

71.99%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

0.00 pp

From 71.99% on 20-09-2026

20-09-202620-10-2026
EPSS score
71.99%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (securityfocus.com)

    Maturity: unknown

  • exploit-databasedosmultipleVerified

    Squid < 3.1 5 - HTTP Version Number Parsing Denial of Service

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Debian2 products
  • squid< 2.7.STABLE3-4.1
  • squid3< 3.0.PRE5-5+etch1
Squid1 product
  • squid2.7.stable1 | 2.7.stable2 | 2.7.stable3 | 2.7.stable4 | 2.7.stable5 | 3.0.stable1 | 3.0.stable2 | 3.0.stable3 | 3.0.stable4 | 3.0.stable5 | 3.0.stable6 | 3.0.stable7 | 3.0.stable8 | 3.0.stable9 | 3.0.stable10 | 3.0.stable11 | 3.0.stable12 | 3.1 | 3.1.0.1 | 3.1.0.2 | 3.1.0.3 | 3.1.0.4

2 vendors · 3 products

References

13 links
Show all 13 references