CVE-2019-12527: Squid proxy heap buffer overflow in Basic Authentication header handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability and high EPSS, but exploitation requires user interaction and no KEV or ransomware evidence exists.

What it is

Squid 4.0.23 through 4.7 decodes Basic Authentication credentials into a global buffer in HttpHeader::getAuth without validating that the decoded length fits, producing a heap-based buffer overflow with attacker-controlled data. Because the overflow is reachable through normal proxy authentication handling, it can corrupt heap memory and potentially lead to remote code execution on the proxy host.

Impact

An attacker who can supply a crafted Authorization header can overwrite heap memory with controlled data, which may result in code execution or at minimum a crash of the Squid process.

Attack surface

Reached over the network via HTTP requests carrying a malformed Basic Authentication header; the CVSS vector indicates no privileges are required but user interaction is required, and the flaw sits in the proxy's authentication parsing path.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented, but EPSS is high at roughly 0.49 (98.8th percentile), and vendor and distribution advisories plus a public patch are available, indicating active interest and easy patch-derived exploitation.

What to do

• Upgrade Squid to a version containing the fix (the vendor changeset patch squid-4-7f73e9c5d17664b882ed32590e6af310c247f320 or later 4.x release).
• Apply the distribution updates: Red Hat RHSA-2019:2593, Ubuntu USN-4065-1, Debian DSA-4507, and the Fedora package announcement.
• If patching is delayed, restrict proxy access to trusted networks and disable or avoid Basic Authentication where feasible.
• Monitor Squid processes for crashes or restarts and treat repeated authentication-related failures as suspicious.

Detection

• Inspect proxy and web logs for HTTP requests with unusually long or malformed Authorization: Basic headers.
• Alert on Squid process crashes, core dumps, or unexpected restarts on proxy hosts.
• Use network monitoring to flag oversized or non-base64-conformant Basic auth credentials sent to the proxy.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.