CVE-2020-8450: Squid reverse proxy buffer overflow via incorrect buffer management

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated buffer overflow in a widely deployed proxy with a very high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Squid before 4.10 mishandles buffers, allowing a remote client to trigger a buffer overflow when Squid operates as a reverse proxy. The flaw is an out-of-bounds write (CWE-787) rooted in incorrect buffer size calculation (CWE-131), and it matters because it is network-reachable without authentication and affects a widely deployed proxy component.

Impact

An attacker can corrupt memory in the Squid process, which may lead to a crash or, depending on memory layout, code execution in the proxy's context. CVSS 3.1 rates confidentiality, integrity and availability impact as low (7.3 HIGH).

Attack surface

Reachable over the network by any remote client that can send requests to a Squid instance configured as a reverse proxy; the CVSS vector shows no privileges (PR:N) and no user interaction (UI:N) required. Only reverse-proxy deployments are described as affected.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is very high (0.7179 probability, 99.394 percentile), indicating substantial predicted exploitation activity. References are vendor advisories and patches only; no public exploit or in-the-wild report is cited in the record.

What to do

• Upgrade Squid to 4.10 or later, or apply the vendor patches referenced in SQUID-2020_1 for the 3.5 and 4 branches.
• Apply distribution updates for Ubuntu (USN-4289-1), Debian (DSA-4682), openSUSE, Fedora and Gentoo (GLSA 202003-34) where Squid is packaged.
• If patching is delayed, restrict network access to reverse-proxy listeners to trusted clients and avoid exposing Squid reverse proxy directly to the internet.
• Monitor vendor advisories for NetApp and other third-party products that bundle Squid and apply their updates.

Detection

• Watch Squid process crashes or restarts, especially abnormal termination signals, on hosts running reverse-proxy configurations.
• Alert on core dumps or memory-corruption indicators from the squid binary and correlate with inbound request volume or unusual request patterns.
• Track Squid version inventory and flag any instance below 4.10 that is configured as a reverse proxy.
• Review proxy access logs for anomalous or malformed requests arriving at reverse-proxy listeners around the time of any crash.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.