Vulnerability record · CVE-2016-4553 · published 10 May 2016
CVE-2016-4553: Squid proxy cache poisoning via Host header in absolute-URI requests
Canonical · Ubuntu Linux
Squid before 3.5.18 and 4.x before 4.0.10 fails to ignore the Host header when a request supplies an absolute-URI, so the two can disagree. A remote attacker can exploit this mismatch to poison the proxy cache, causing other users to receive attacker-controlled content for a cached URL.
Description
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
Automated analysis
high priorityCVSS 8.6 with network reachability, no authentication, and full integrity impact on a shared cache, plus a very high EPSS score, make this a serious exposure despite no KEV listing.
What it is
Squid before 3.5.18 and 4.x before 4.0.10 fails to ignore the Host header when a request supplies an absolute-URI, so the two can disagree. A remote attacker can exploit this mismatch to poison the proxy cache, causing other users to receive attacker-controlled content for a cached URL.
Impact
An attacker can inject false responses into the shared cache, so subsequent users requesting the affected URL receive the attacker's content. Integrity is fully compromised at the scope of the proxy's served content; confidentiality and availability are not affected per the CVSS vector.
Attack surface
Reached over the network by sending a crafted HTTP request to the Squid proxy; the CVSS vector shows no privileges and no user interaction required. Any client able to route requests through the proxy can attempt it.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high (0.79969, 99.6th percentile), indicating strong predicted likelihood of exploitation activity.
What to do
- Upgrade Squid to 3.5.18 or later, or 4.0.10 or later, or apply the vendor patch squid-3.5-14039.
- Apply distribution updates: Ubuntu USN-2995-1, Debian DSA-3625, Red Hat RHSA-2016:1139/1140, Gentoo GLSA 201607-01, or the relevant openSUSE advisory.
- Where patching is delayed, restrict who can send requests through the proxy and avoid caching responses for untrusted clients.
- Review proxy configuration for cache handling of absolute-URI requests and reduce shared-cache exposure to untrusted networks.
Detection
- Inspect proxy logs for requests where the absolute-URI host and the Host header disagree.
- Monitor for anomalous cached responses or unexpected content served for frequently requested URLs.
- Alert on cache-fill events tied to requests from unusual or untrusted client sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-4553 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-4553), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
