{"id":"CVE-2016-4553","details":"client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.","modified":"2026-05-18T05:48:33.719791032Z","published":"2016-05-10T19:59:00.137Z","related":["SUSE-SU-2016:2008-1","SUSE-SU-2016:2089-1","openSUSE-SU-2024:11403-1"],"database_specific":{"unresolved_ranges":[{"vendor_product":"canonical:ubuntu_linux","cpes":["cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*","cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"],"extracted_events":[{"last_affected":"12.04"},{"last_affected":"14.04"},{"last_affected":"15.10"},{"last_affected":"16.04"}],"source":"CPE_FIELD"},{"cpes":["cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*"],"vendor_product":"oracle:linux","extracted_events":[{"last_affected":"7"}],"source":"CPE_FIELD"}]},"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html"},{"type":"WEB","url":"http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14039.patch"},{"type":"ADVISORY","url":"http://bugs.squid-cache.org/show_bug.cgi?id=4501"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3625"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1035768"},{"type":"ADVISORY","url":"http://www.squid-cache.org/Advisories/SQUID-2016_7.txt"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2995-1"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1139"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1140"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201607-01"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/squid-cache/squid","events":[{"introduced":"0"},{"last_affected":"0a4efb98f1e84bb7392c7ecc9c7deb0381458b0f"},{"last_affected":"1243ec712bf76c549ba7f48fcdc30d98ce550449"},{"last_affected":"6c4d7196d05c95c406bafce712c8768cc8dc3beb"},{"last_affected":"2552ca552397fb9d23f06d4f1211c505205aee95"},{"last_affected":"78121f9a195344616290ecdd4f7f9dd521daaf1a"},{"last_affected":"ff87fda5fe2e205785b15ebdb243ad812effc981"},{"last_affected":"404063c59bb4ffa6c5a005611c4375f82ddd423f"},{"last_affected":"7f53f09fb9dc2d6ac4f49ceae514ad6488e2600e"},{"last_affected":"97f9388a0edced1b168f57afaa6fe54b135dccc9"},{"last_affected":"15fb77e4092a910ea4abe83594a1ac9f79cae333"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"3.5.17"},{"last_affected":"4.0.1"},{"last_affected":"4.0.2"},{"last_affected":"4.0.3"},{"last_affected":"4.0.4"},{"last_affected":"4.0.5"},{"last_affected":"4.0.6"},{"last_affected":"4.0.7"},{"last_affected":"4.0.8"},{"last_affected":"4.0.9"}],"cpe":["cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.1:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.3:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.4:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.5:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.6:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.7:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.8:*:*:*:*:*:*:*","cpe:2.3:a:squid-cache:squid:4.0.9:*:*:*:*:*:*:*"],"source":"CPE_FIELD"}}],"versions":["SQUID_3_5_17","SQUID_4_0_9","SQUID_3_5_16","SQUID_4_0_8","SQUID_3_5_15","SQUID_4_0_7","SQUID_3_5_14","SQUID_4_0_6","SQUID_4_0_5","SQUID_3_5_13","SQUID_4_0_4","SQUID_3_5_12","SQUID_4_0_3","SQUID_3_5_11","SQUID_4_0_2","SQUID_4_0_1","SQUID_3_5_10","SQUID_3_5_9","SQUID_3_5_8","SQUID_3_5_7","SQUID_3_5_6","SQUID_3_5_5","SQUID_3_5_4","SQUID_3_5_3","SQUID_3_5_2","SQUID_3_5_1","SQUID_3_5_0_4","SQUID_3_5_0_3","SQUID_3_5_0_2","SQUID_3_5_0_1","take00","SQUID_3_0_RC1","SQUID_3_0_PRE7","SQUID_3_0_PRE6","SQUID_3_0_PRE5","SQUID_3_0_PRE4","SQUID_3_0_PRE3","SQUID_3_0_PRE2","SQUID_3_0_PRE1","HISTORIC_RELEASES"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-4553.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}