CVE-2021-46784

Published: Jul 17, 2022Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses.

Affected (6)

Products: Squid Cache: Squid · Debian: Debian Linux

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Squid Cache Squid	From 3.0 to 3.5.28
Squid Cache Squid	From 4.0 to 4.17
Squid Cache Squid	From 5.0 to 5.6

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 11.0
Debian Debian Linux	Version 12.0

Related CWEs

CWE-617

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (18)

http://www.openwall.com/lists/oss-security/2023/10/13/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2023/10/13/10

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2023/10/21/1

Source: cve@mitre.org

http://www.squid-cache.org/Versions/v4/changesets/SQUID-2021_7.patch

Source: cve@mitre.org

Broken Link

http://www.squid-cache.org/Versions/v5/changesets/SQUID-2021_7.patch

Source: cve@mitre.org

PatchVendor Advisory

https://github.com/squid-cache/squid/commit/5e2ea2b13bd98f53e29964ca26bb0d602a8a12b9

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/squid-cache/squid/security/advisories/GHSA-f5cp-6rh3-284w

Source: cve@mitre.org

MitigationPatchThird Party Advisory

https://security-tracker.debian.org/tracker/CVE-2021-46784

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20221223-0007/

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2023/10/13/1