Vulnerability record · CVE-2014-3609 · published 11 September 2014
CVE-2014-3609: Squid proxy crash via crafted Range header byte-range values
Squid Cache · Squid
Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 fails to properly validate byte-range values in HTTP Range headers, causing a crash in HttpHdrRange.cc. A remote, unauthenticated attacker can send a single crafted request to take down the proxy, disrupting all traffic that depends on it.
Description
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
high priorityUnauthenticated remote crash of a widely deployed proxy with very high EPSS probability warrants prompt patching despite the medium CVSS score.
What it is
Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 fails to properly validate byte-range values in HTTP Range headers, causing a crash in HttpHdrRange.cc. A remote, unauthenticated attacker can send a single crafted request to take down the proxy, disrupting all traffic that depends on it.
Impact
An attacker can cause a denial of service by crashing the Squid process, interrupting web access for all users behind the proxy. There is no confidentiality or integrity impact; only availability is affected.
Attack surface
Reachable over the network via HTTP requests containing crafted Range headers with unidentifiable byte-range values. No authentication or user interaction is required, as reflected by the AV:N/AC:L/Au:N vector.
Exploitation
Not listed in CISA KEV and no public exploit tags are present in the references, but EPSS is 0.5622 (99th percentile), indicating a high modeled likelihood of exploitation activity.
What to do
- Upgrade Squid to 3.3.12 or 3.4.6 (or later) as specified in the vendor advisory SQUID-2014_2.
- Apply the distribution vendor patches (Red Hat RHSA-2014-1147, Debian DSA-3014/DSA-3139, Ubuntu USN-2327-1, openSUSE advisories) if a full upgrade is not immediately possible.
- Restrict or filter HTTP Range headers at the network edge or reverse proxy where operationally feasible.
- Monitor Squid processes for unexpected restarts and enable automatic service recovery to limit outage duration.
Detection
- Inspect HTTP request logs for Range headers containing malformed or unidentifiable byte-range values.
- Alert on Squid process crashes or restarts correlated with inbound HTTP requests.
- Use IDS/IPS signatures for CVE-2014-3609 to flag crafted Range header requests.
- Baseline normal Range header usage and alert on anomalous patterns from single source IPs.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2014-3609 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2014-3609), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
