{"schemaVersion":3,"id":"CVE-2020-15810","aliases":["ALPINE-CVE-2020-15810","UBUNTU-CVE-2020-15810","DEBIAN-CVE-2020-15810"],"status":"published","duplicateOf":null,"title":null,"description":"An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.","dates":{"published":"2020-09-02T16:34:04.000Z","modified":"2024-08-04T13:30:21.842Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","exploitability":7.2,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":3.5,"severity":"low","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02427,"percentile":0.83956,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.09900000000000013,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02526},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02427,"percentile":0.83956}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02526,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02427,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02427,"percentile":0.83956}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-444","name":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')","description":"The product acts as an intermediary HTTP agent\n         (such as a proxy or firewall) in the data flow between two\n         entities such as a client and server, but it does not\n         interpret malformed HTTP requests or responses in ways that\n         are consistent with how the messages will be processed by\n         those entities that are at the ultimate destination.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/444.html"}],"affected":[{"vendor":"alpine","product":"squid","name":"squid","label":"squid","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/squid","purlType":"apk","versions":[{"text":"≥ 5.0, < 4.13-r0","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0, < 4.13.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.0, < 4.13-r0 | ≥ 5.0, < 4.13.0-r0","eol":null,"hubHref":null},{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"16.04","noFixRecorded":false,"fixedIn":null},{"text":"18.04","noFixRecorded":false,"fixedIn":null},{"text":"20.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"16.04 | 18.04 | 20.04","eol":{"isEol":true,"eolDate":"2021-04-02T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"16.04","label":"16.04 'Xenial Xerus' (LTS)","eolFrom":"2021-04-02T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"16.04.7"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"squid","name":"squid","label":"squid","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/squid","purlType":"deb","versions":[{"text":"< 4.13-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.13-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"squid","name":"squid","label":"squid","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/squid","purlType":"deb","versions":[{"text":"< 4.10-1ubuntu1.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.10-1ubuntu1.2","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"squid3","name":"squid3","label":"squid3","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/squid3","purlType":"deb","versions":[{"text":"< 3.5.12-1ubuntu7.15","noFixRecorded":false,"fixedIn":null},{"text":"< 3.5.27-1ubuntu1.9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.5.12-1ubuntu7.15 | < 3.5.27-1ubuntu1.9","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.0 | 10.0","eol":{"isEol":true,"eolDate":"2022-07-01T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"9","label":"9 (Stretch)","eolFrom":"2022-07-01T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"9.13"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"31","noFixRecorded":false,"fixedIn":null},{"text":"32","noFixRecorded":false,"fixedIn":null},{"text":"33","noFixRecorded":false,"fixedIn":null}],"versionsText":"31 | 32 | 33","eol":{"isEol":true,"eolDate":"2020-11-24T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"31","label":"31","eolFrom":"2020-11-24T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"opensuse","product":"leap","name":"leap","label":"leap","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"15.1","noFixRecorded":false,"fixedIn":null},{"text":"15.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"15.1 | 15.2","eol":{"isEol":true,"eolDate":"2021-02-02T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"15.1","label":"Leap 15.1","eolFrom":"2021-02-02T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/leap"},{"vendor":"squid-cache","product":"squid","name":"squid","label":"squid","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 4.13","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0, < 5.0.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.13 | ≥ 5.0, < 5.0.4","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"squid","label":"Squid","category":"server-app"}},"hubHref":"/vendor/squid-cache/squid"}],"affectedCount":9,"eol":{"hasEol":true,"count":4},"references":[{"url":"https://github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m","label":"github.com/squid-cache/squid/security/advisories/GHSA-3365-q9qx-f98m","hostname":"github.com","tags":["X Refsource MISC","REPORT","Mitigation","Third Party Advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4751","label":"www.debian.org/security/2020/dsa-4751","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://usn.ubuntu.com/4477-1/","label":"usn.ubuntu.com/4477-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HJJDI7JQFGQLVNCKMVY64LAFMKERAOK7/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMTFLVB7GLRF2CKGFPZ4G4R5DIIPHWI3/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html","label":"lists.opensuse.org/opensuse-security-announce/2020-09/msg00012.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html","label":"lists.opensuse.org/opensuse-security-announce/2020-09/msg00017.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Mailing List","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BE6FKUN7IGTIR2MEEMWYDT7N5EJJLZI2/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://usn.ubuntu.com/4551-1/","label":"usn.ubuntu.com/4551-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/10/msg00005.html","label":"lists.debian.org/debian-lts-announce/2020/10/msg00005.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210219-0007/","label":"security.netapp.com/advisory/ntap-20210219-0007/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20210226-0007/","label":"security.netapp.com/advisory/ntap-20210226-0007/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Broken Link"]},{"url":"https://security.netapp.com/advisory/ntap-20210226-0006/","label":"security.netapp.com/advisory/ntap-20210226-0006/","hostname":"security.netapp.com","tags":["X Refsource CONFIRM","Third Party Advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-15810","label":"security.alpinelinux.org/vuln/CVE-2020-15810","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15810","label":"ubuntu.com/security/CVE-2020-15810","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-4477-1","label":"ubuntu.com/security/notices/USN-4477-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4551-1","label":"ubuntu.com/security/notices/USN-4551-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15810","label":"www.cve.org/CVERecord?id=CVE-2020-15810","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15810","label":"security-tracker.debian.org/tracker/CVE-2020-15810","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-2394-1","DSA-4751-1","MGASA-2020-0361","OPENSUSE-SU-2020:1346-1","OPENSUSE-SU-2020:1369-1","OPENSUSE-SU-2024:11403-1","RHSA-2020:3623","RHSA-2020:4082","SUSE-SU-2020:14590-1","SUSE-SU-2020:2442-1","SUSE-SU-2020:2443-1","SUSE-SU-2020:2471-1","SUSE-SU-2022:14908-1","USN-4477-1","USN-4551-1"],"duplicates":[],"related":["OPENSUSE-SU-2020:1346-1","OPENSUSE-SU-2020:1369-1","OPENSUSE-SU-2024:11403-1","SUSE-SU-2020:14590-1","SUSE-SU-2020:2442-1","SUSE-SU-2020:2443-1","SUSE-SU-2020:2471-1","SUSE-SU-2022:14908-1","USN-4477-1","USN-4551-1"]},"timeline":[{"kind":"published","date":"2020-09-02T16:34:04.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T13:30:21.842Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":26,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T04:41:17.676Z","stale":false,"partial":false}}