- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 15
- Public CVEs
- 60
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 2 days
The project commits to a manual acknowledgement within 48 hours
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
15 assets you may test, 6 excluded.
Web 1
- https://www.squid-cache.org
Products and areas 14
- ESI processing and the assembly of edge-included fragments
- External authentication and the helper protocol, covering basic, digest, NTLM and negotiate helpers and the data passed across that boundary
- HTTP request and response parsing in full, covering headers, chunked encoding, absolute-form and origin-form request targets, and the reconciliation of framing headers
- SSL-bump, dynamic certificate generation and the whole TLS interception path, including how a certificate decision is made and cached
- The ACL engine and every ACL type, since that is the machinery enforcing the network's actual policy
- The cache_digest implementation and the digest exchange with peers
- The cache: key derivation, storage, revalidation, variant selection, and every path by which one client's stored response could reach another client
- The cache manager interface and the SNMP agent, both reachable over the network
- The FTP gateway and the other non-HTTP gateways compiled into the daemon
- The ICAP and eCAP clients used for content adaptation, and the trust placed in an adaptation service's response
- The logging path and every point where attacker-controlled data reaches an access log or a store log
- The peer protocols, ICP and HTCP, which accept traffic from other cache nodes on the network rather than from clients
- The SECURITY.md asks for security reports on the closed squid-bugs list and holds them in confidence until the impact is established. It draws no boundary narrower than Squid itself
- URN handling and the other legacy URI schemes still compiled in by default
Out of scope (6)
- Configurations that leave the proxy open to the internet, which is an operator decision rather than a Squid defect
- Denial of service proportional to request volume with no amplification factor
- Distribution patches and packaging rather than upstream Squid
- Reports filed as public GitHub issues rather than on the closed list
- Third-party helper programs that are not shipped in the Squid tree
- Upstream libraries such as OpenSSL, unless Squid's own use of them is what makes the issue reachable
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy. "We" in these lines means Sorona, not this site.
While testing
-
Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly.
-
Report to the squid-bugs closed mailing list, the channel the SECURITY.md names. Anyone can post to it and security reports are held in confidence at least until the impact is established
-
The project commits to a manual acknowledgement within 48 hours, and GPG keys are available on request if the finding needs encrypting in transit
-
Say which mode you tested: forward proxy, reverse proxy or transparent interception. The same code path carries different trust assumptions in each
-
Name the protocol and the helper involved. Squid speaks HTTP, HTTPS, FTP, ICP, HTCP, ICAP and ESI, and several recent findings were in the less-travelled ones
-
Include the squid.conf that reproduces it. Squid's behaviour is configuration-driven to an unusual degree and a default build often will not show the bug
Not accepted
-
Third-party helper programs that are not shipped in the Squid tree
-
Distribution patches and packaging rather than upstream Squid
-
Configurations that leave the proxy open to the internet, which is an operator decision rather than a Squid defect
-
Upstream libraries such as OpenSSL, unless Squid's own use of them is what makes the issue reachable
-
Denial of service proportional to request volume with no amplification factor
-
Reports filed as public GitHub issues rather than on the closed list
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-47729 | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbe | Medium 6.5 | 16 Jul 2026 |
| CVE-2026-50012 | Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request mes | Medium 5.5 | 16 Jul 2026 |
| CVE-2026-33515 | Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable | Medium 6.9 | 26 Mar 2026 |
| CVE-2026-33526 | Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non | Critical 9.2 | 26 Mar 2026 |
| CVE-2026-32748 | Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid de | High 8.7 | 26 Mar 2026 |
| CVE-2025-62168 | Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulnerability allows a script to bypass browser security protections and learn the credentials a trusted client uses to authenticate. This potentially allows a remote client to identify security tokens or credentials used int | Critical 10.0 | 17 Oct 2025 |
| CVE-2025-59362 | Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c. | Medium 4.0 | 26 Sep 2025 |
| CVE-2025-54574 | Squid is a caching proxy for the Web. In versions 6.3 and below, Squid is vulnerable to a heap buffer overflow and possible remote code execution attack when processing URN due to incorrect buffer management. This has been fixed in version 6.4. To work around this issue, disable URN access permissions. | Critical 9.3 | 1 Aug 2025 |
| CVE-2024-45802 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to Input Validation, Premature Release of Resource During Expected Lifetime, and Missing Release of Resource after Effective Lifetime bugs, Squid is vulnerable to Denial of Service attacks by a trusted server against all clients using the proxy. This bug is fixed in the default build configuration of Squid | High 7.5 | 28 Oct 2024 |
| CVE-2024-37894 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Out-of-bounds Write error when assigning ESI variables, Squid is susceptible to a Memory Corruption error. This error can lead to a Denial of Service attack. | Medium 6.3 | 25 Jun 2024 |
| CVE-2024-25111 | Squid is a web proxy cache. Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. This problem allows a remote attacker to cause Denial of Service when sending a crafted, chunked, encoded HTTP Message. This bug is fixed in Squid version 6.8. In addition, patches addressing this p | High 8.6 | 6 Mar 2024 |
| CVE-2024-25617 | Squid is an open source caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. This problem allows a remote client or a remote server to perform Denial of Service when sending oversized headers in HTTP messages. In versions of Squid prior to 6.5 this can be | Medium 5.3 | 14 Feb 2024 |
| CVE-2024-23638 | Squid is a caching proxy for the Web. Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. This problem allows a trusted client to perform Denial of Service when generating error pages for Client Manager reports. Squid older than 5.0.5 have not been tested and should be assumed to be vulnerable. All S | Medium 6.5 | 24 Jan 2024 |
| CVE-2023-50269 | Squid is a caching proxy for the Web. Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. This problem allows a remote client to perform Denial of Service attack by sending a large X-Forwarded-For header when the follow_x_forwarded_for | High 8.6 | 14 Dec 2023 |
| CVE-2023-49285 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. | High 8.6 | 4 Dec 2023 |
| CVE-2023-49286 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to an Incorrect Check of Function Return Value bug Squid is vulnerable to a Denial of Service attack against its Helper process management. This bug is fixed by Squid version 6.5. Users are advised to upgrade. There are no known workarounds for this vulnerability. | High 8.6 | 4 Dec 2023 |
| CVE-2023-49288 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Affected versions of squid are subject to a a Use-After-Free bug which can lead to a Denial of Service attack via collapsed forwarding. All versions of Squid from 3.5 up to and including 5.9 configured with "collapsed_forwarding on" are vulnerable. Configurations with "collapsed_forwarding off" or without a "collapsed_forw | High 8.6 | 4 Dec 2023 |
| CVE-2023-46728 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service attack against Squid's Gopher gateway. The gopher protocol is always available and enabled in Squid prior to Squid 6.0.1. Responses triggering this bug are possible to be received from any gopher server, even those without malicious intent. Go | High 7.5 | 6 Nov 2023 |
| CVE-2023-46846 | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall and frontend security systems. | Critical 9.3 | 3 Nov 2023 |
| CVE-2023-46847 | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication. | High 8.6 | 3 Nov 2023 |
| CVE-2023-46848 | Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input. | High 8.6 | 3 Nov 2023 |
| CVE-2023-5824 | A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a large header is retrieved from the disk cache, resulting in a denial of service. | High 7.5 | 3 Nov 2023 |
| CVE-2023-46724 | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled using `--with-openssl` are vulnerable to a Denial of Service attack against SSL Certificate validation. This problem allows a remote server to perform Denial of Service against Squid Proxy by initiating a TLS Handshake with a specially crafted | High 8.6 | 1 Nov 2023 |
| CVE-2022-41317 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Information about clients using the proxy via an HTTPS request to an internal cache manager URL. This is fixed in 5.7. | Medium 6.5 | 25 Dec 2022 |
| CVE-2022-41318 | A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helpers are vulnerable to reading unintended memory locations. In some configurations, cleartext credentials from these locations are sent to a client. This is fixed in 5.7. | High 8.6 | 25 Dec 2022 |
| CVE-2021-46784 | In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 5.6, due to improper buffer management, a Denial of Service can occur when processing long Gopher server responses. | Medium 6.5 | 17 Jul 2022 |
| CVE-2021-41611 | An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectly classify certain certificates as trusted. This problem allows a remote server to obtain security trust well improperly. This indication of trust may be passed along to clients, allowing access to unsafe or hijacked services. | High 7.5 | 18 Oct 2021 |
| CVE-2021-31807 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent. | Medium 6.5 | 8 Jun 2021 |
| CVE-2021-33620 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server. | Medium 6.5 | 28 May 2021 |
| CVE-2021-31808 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this. | Medium 6.5 | 27 May 2021 |
| CVE-2021-31806 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing. | Medium 6.5 | 27 May 2021 |
| CVE-2021-28651 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption. | High 7.5 | 27 May 2021 |
| CVE-2021-28652 | An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to incorrect parser validation, it allows a Denial of Service attack against the Cache Manager API. This allows a trusted client to trigger memory leaks that. over time, lead to a Denial of Service via an unspecified short query string. This attack is limited to clients with Cache Manager API access privilege. | Medium 4.9 | 27 May 2021 |
| CVE-2021-28662 | An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic. | Medium 6.5 | 27 May 2021 |
| CVE-2020-25097 | An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings. | High 8.6 | 19 Mar 2021 |
| CVE-2021-28116 | Squid through 4.14 and 5.x through 5.0.5, in some configurations, allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody. | Low 3.7 | 9 Mar 2021 |
| CVE-2020-15810 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relax | Medium 6.5 | 2 Sep 2020 |
| CVE-2020-15811 | An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string sea | Medium 6.5 | 2 Sep 2020 |
| CVE-2020-24606 | Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF. | High 8.6 | 24 Aug 2020 |
| CVE-2020-14058 | An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default certificate validation helper are vulnerable to a Denial of Service when opening a TLS connection to an attacker-controlled server for HTTPS. This occurs because unrecognized error values are mapped to NULL, but later code expects that each error value is mapped | High 7.5 | 30 Jun 2020 |
| CVE-2020-14059 | An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list. | Medium 6.5 | 30 Jun 2020 |
| CVE-2020-15049 | An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request Smuggling and Poisoning attack can succeed against the HTTP cache. The client sends an HTTP request with a Content-Length header containing "+\ "-" or an uncommon shell whitespace character prefix to the length field-value. | Critical 9.9 | 30 Jun 2020 |
| CVE-2020-11945 | An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials). | Critical 9.8 | 23 Apr 2020 |
| CVE-2019-12520 | An issue was discovered in Squid through 4.7 and 5. When receiving a request, Squid checks its cache to see if it can serve up a response. It does this by making a MD5 hash of the absolute URL of the request. If found, it servers the request. The absolute URL can include the decoded UserInfo (username and password) for certain protocols. This decoded info is prepended to the domain. This allows an | High 7.5 | 15 Apr 2020 |
| CVE-2019-12519 | An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that th | Critical 9.8 | 15 Apr 2020 |
| CVE-2019-12524 | An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows | Critical 9.8 | 15 Apr 2020 |
| CVE-2019-12522 | An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leave_suid call. leave_suid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child process to escalate their privileges back to root. | Medium 4.5 | 15 Apr 2020 |
| CVE-2019-12521 | An issue was discovered in Squid through 4.7. When Squid is parsing ESI, it keeps the ESI elements in ESIContext. ESIContext contains a buffer for holding a stack of ESIElements. When a new ESIElement is parsed, it is added via addStackElement. addStackElement has a check for the number of elements in this buffer, but it's off by 1, leading to a Heap Overflow of 1 element. The overflow is within t | Medium 5.9 | 15 Apr 2020 |
| CVE-2019-18860 | Squid before 4.9, when certain web browsers are used, mishandles HTML in the host (aka hostname) parameter to cachemgr.cgi. | Medium 6.1 | 20 Mar 2020 |
| CVE-2019-12528 | An issue was discovered in Squid before 4.10. It allows a crafted FTP server to trigger disclosure of sensitive information from heap memory, such as information associated with other users' sessions or non-Squid processes. | High 7.5 | 4 Feb 2020 |
| CVE-2020-8449 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways to access server resources prohibited by earlier security filters. | High 7.5 | 4 Feb 2020 |
| CVE-2020-8450 | An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid instance acting as a reverse proxy. | High 7.3 | 4 Feb 2020 |
| CVE-2020-8517 | An issue was discovered in Squid before 4.10. Due to incorrect input validation, the NTLM authentication credentials parser in ext_lm_group_acl may write to memory outside the credentials buffer. On systems with memory access protections, this can result in the helper process being terminated unexpectedly. This leads to the Squid process also terminating and a denial of service for all clients usi | High 7.5 | 4 Feb 2020 |
| CVE-2019-18676 | An issue was discovered in Squid 3.x and 4.x through 4.8. Due to incorrect input validation, there is a heap-based buffer overflow that can result in Denial of Service to all clients using the proxy. Severity is high due to this vulnerability occurring before normal security checks; any remote client that can reach the proxy port can trivially perform the attack via a crafted URI scheme. | High 7.5 | 26 Nov 2019 |
| CVE-2019-18677 | An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to. | Medium 6.1 | 26 Nov 2019 |
| CVE-2019-18678 | An issue was discovered in Squid 3.x and 4.x through 4.8. It allows attackers to smuggle HTTP requests through frontend software to a Squid instance that splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches (between a client and Squid) with attacker-controlled content at arbitrary URLs. Effects are isolated to software between the attacker client and Squid. | Medium 5.3 | 26 Nov 2019 |
| CVE-2019-18679 | An issue was discovered in Squid 2.x, 3.x, and 4.x through 4.8. Due to incorrect data management, it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code executio | High 7.5 | 26 Nov 2019 |
| CVE-2019-12523 | An issue was discovered in Squid before 4.9. When handling a URN request, a corresponding HTTP request is made. This HTTP request doesn't go through the access checks that incoming HTTP requests go through. This causes all access checks to be bypassed and allows access to restricted HTTP servers, e.g., an attacker can connect to HTTP servers that only listen on localhost. | Critical 9.1 | 26 Nov 2019 |
| CVE-2019-12526 | An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in the heap. | Critical 9.8 | 26 Nov 2019 |
| CVE-2019-12854 | Due to incorrect string termination, Squid cachemgr.cgi 4.0 through 4.7 may access unallocated memory. On systems with memory access protections, this can cause the CGI process to terminate unexpectedly, resulting in a denial of service for all clients using it. | High 7.5 | 15 Aug 2019 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 8 Last 12 months 41 Lifetime Memory safety 45 % Info disclosure 25 % Denial of service 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview Squid is the caching proxy sitting in the middle of enterprise, ISP and school networks, shipped in every major Linux distribution and embedded in a long tail of appliances. Its position is the problem: it terminates and re-issues everyone's traffic, so a memory bug in it is reached by whatever the network was already sending. SQUID-2026:1 is the reference point, a critical denial of service in ICP request handling published in March 2026. The project published eight advisories in the last twelve months out of forty-one in its life, against a visibly under-resourced maintainer group with no money behind it. sorona.xyz pays you directly on qualified, reproduced findings. In scope The SECURITY.md asks for security reports on the closed squid-bugs list and holds them in confidence until the impact is established. It draws no boundary narrower than Squid itself HTTP request and response parsing in full, covering headers, chunked encoding, absolute-form and origin-form request targets, and the reconciliation of framing headers The cache: key derivation, storage, revalidation, variant selection, and every path by which one client's stored response could reach another client The cache_digest implementation and the digest exchange with peers The peer protocols, ICP and HTCP, which accept traffic from other cache nodes on the network rather than from clients The FTP gateway and the other non-HTTP gateways compiled into the daemon SSL-bump, dynamic certificate generation and the whole TLS interception path, including how a certificate decision is made and cached The ACL engine and every ACL type, since that is the machinery enforcing the network's actual policy External authentication and the helper protocol, covering basic, digest, NTLM and negotiate helpers and the data passed across that boundary The ICAP and eCAP clients used for content adaptation, and the trust placed in an adaptation service's response ESI processing and the assembly of edge-included fragments URN handling and the other legacy URI schemes still compiled in by default The cache manager interface and the SNMP agent, both reachable over the network The logging path and every point where attacker-controlled data reaches an access log or a store log Out of scope Third-party helper programs that are not shipped in the Squid tree Distribution patches and packaging rather than upstream Squid Configurations that leave the proxy open to the internet, which is an operator decision rather than a Squid defect Upstream libraries such as OpenSSL, unless Squid's own use of them is what makes the issue reachable Denial of service proportional to request volume with no amplification factor Reports filed as public GitHub issues rather than on the closed list Most-valued findings Memory corruption reachable from a request or from an upstream response. This is the densest class in the recent record: SQUID-2026:5 corrupted memory in cache_digest, and CVE-2025-54574 was a critical heap overflow in URN handling Information disclosure out of error handling or a gateway, the shape of the critical SQUID-2025:2 and of the FTP gateway memory disclosure in SQUID-2026:4. What leaks from a proxy is other people's traffic Anything in the peer protocols, ICP, HTCP or cache digests, that a machine on the network can reach without ever being a client. SQUID-2026:1 was a critical denial of service in exactly that surface Cache poisoning through key derivation, variant selection or revalidation, because one poisoned object is served to every user behind the proxy ACL evaluation defects that let a request through a rule the administrator wrote to block it, since Squid is frequently the only enforcement point on the network SSL-bump and certificate-generation defects. The proxy is a deliberate man in the middle and its certificate decisions are the only thing left preserving the guarantee Out-of-bounds reads in parsing, the class SQUID-2026:3 landed in, on a codebase where the parser is fed by every device on the network Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Report to the squid-bugs closed mailing list, the channel the SECURITY.md names. Anyone can post to it and security reports are held in confidence at least until the impact is established The project commits to a manual acknowledgement within 48 hours, and GPG keys are available on request if the finding needs encrypting in transit Advisories are numbered SQUID-YYYY:N and published as GitHub Security Advisories, so a confirmed finding gets a GHSA as well as a CVE Say which mode you tested: forward proxy, reverse proxy or transparent interception. The same code path carries different trust assumptions in each Name the protocol and the helper involved. Squid speaks HTTP, HTTPS, FTP, ICP, HTCP, ICAP and ESI, and several recent findings were in the less-travelled ones Include the squid.conf that reproduces it. Squid's behaviour is configuration-driven to an unusual degree and a default build often will not show the bug The Internet Bug Bounty used to pay for Squid findings and stopped accepting submissions in March 2026, so there is no paid channel left to try Disclosure Coordinated on the closed squid-bugs list with a 48-hour manual acknowledgement, then published as a numbered SQUID advisory and a GitHub Security Advisory, a pipeline the project has run since June 2020. Distribution packaging sets the timing rather than a published day count: Squid ships in every major Linux distribution, so the embargo runs until the backports are ready. Hold detail until then, because the deployments that matter are on distro packages rather than on upstream builds. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability