Vulnerability record · CVE-2010-3072 · published 20 September 2010
CVE-2010-3072: Squid string-comparison NULL pointer dereference denial of service
Squid Cache · Squid
The string-comparison functions in String.cci in Squid mishandle crafted input, causing a NULL pointer dereference. A remote attacker can crash the Squid daemon, disrupting proxy service for all users behind it.
Description
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityUnauthenticated remote denial of service against a widely deployed proxy, with high EPSS despite no KEV listing.
What it is
The string-comparison functions in String.cci in Squid mishandle crafted input, causing a NULL pointer dereference. A remote attacker can crash the Squid daemon, disrupting proxy service for all users behind it.
Impact
An unauthenticated remote attacker can crash the Squid proxy daemon, causing a denial of service for all clients relying on that proxy.
Attack surface
Reachable over the network via a crafted request to the Squid proxy; the CVSS vector (AV:N/AC:L/Au:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged, but EPSS is high (0.599, 99th percentile), suggesting elevated likelihood of exploitation activity.
What to do
- Upgrade Squid to 3.1.8 or later, or 3.2.0.2 or later, per the vendor advisory and patches.
- Apply the vendor changeset patches (squid-3.0-9189, squid-3.1-10090) if a full upgrade is not immediately possible.
- Apply distribution security updates (Debian DSA-2111, Fedora, openSUSE advisories).
- Restrict network access to the Squid proxy to trusted clients where feasible.
- Monitor Squid processes for unexpected restarts or crashes as a stopgap indicator.
Detection
- Monitor Squid daemon logs and system logs for crash or restart events indicating NULL pointer dereference.
- Watch for repeated abnormal termination of the squid process correlated with inbound proxy requests.
- Use process supervision or systemd restart counters to alert on frequent Squid restarts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2010-3072 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-3072), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
