CVE-2013-4123: Squid proxy denial of service via crafted Host header port number

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is remotely triggerable without authentication and can take down a shared proxy, and the very high EPSS score suggests active exploitation is likely despite no KEV listing.

What it is

Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 fails to properly validate the port number in an HTTP Host header, allowing a remote attacker to trigger a denial of service. The flaw is an improper input validation issue in client_side_request.cc. Because Squid is commonly deployed as a forward or reverse proxy, a crash can disrupt web access for all users behind it.

Impact

An unauthenticated remote attacker can crash the Squid process, causing a denial of service for all proxied traffic. There is no evidence in the record of data exposure or code execution.

Attack surface

Reachable over the network by sending an HTTP request with a crafted port number in the Host header to a Squid proxy. No authentication or user interaction is required per the CVSS vector AV:N/AC:L/Au:N.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is very high at 0.80451 (99.6th percentile), indicating elevated likelihood of exploitation activity.

What to do

• Upgrade Squid to 3.2.13 or 3.3.8 or later, applying the vendor patches referenced in the advisory.
• Apply the distribution vendor update (e.g., openSUSE security update) if using a packaged Squid build.
• Restrict network access to the Squid proxy to trusted clients where feasible.
• Monitor Squid logs for repeated malformed Host headers and rate-limit or block offending sources.

Detection

• Inspect Squid access and cache logs for HTTP requests with malformed or non-numeric port values in the Host header.
• Alert on Squid process crashes or unexpected restarts correlated with inbound proxy requests.
• Use network monitoring to flag Host headers containing unusual port syntax or out-of-range port numbers.
• Track repeated requests from a single source that coincide with proxy availability loss.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.