Vulnerability record · CVE-2021-31806 · published 27 May 2021
CVE-2021-31806: Squid proxy memory-management bug allows DoS via HTTP Range requests
Squid Cache · Squid
Squid before 4.15 and 5.x before 5.0.6 contains a memory-management bug in HTTP Range request processing. A remote client can trigger a denial of service that affects all clients using the proxy. The flaw is remotely reachable and requires only low privileges, making it a practical availability risk for shared proxy deployments.
Description
An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a memory-management bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy) via HTTP Range request processing.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityThe flaw is remotely triggerable, affects all proxy clients, and carries a very high EPSS score despite a medium CVSS rating and no KEV listing.
What it is
Squid before 4.15 and 5.x before 5.0.6 contains a memory-management bug in HTTP Range request processing. A remote client can trigger a denial of service that affects all clients using the proxy. The flaw is remotely reachable and requires only low privileges, making it a practical availability risk for shared proxy deployments.
Impact
An attacker can crash or exhaust the Squid proxy, denying web access to every client routed through it. There is no confidentiality or integrity impact; the effect is purely availability.
Attack surface
Reached over the network by sending crafted HTTP Range requests to the Squid proxy (CVSS AV:N). Authentication is not required at the network layer, though the vector indicates low privileges (PR:L), and no user interaction is needed.
Exploitation
Not listed in CISA KEV and no ransomware association is documented, but EPSS is very high (0.95785, 99.87th percentile), indicating elevated likelihood of exploitation activity. References include vendor patches and third-party advisories, with no public exploit tag supplied.
What to do
- Upgrade Squid to 4.15 or later, or 5.0.6 or later, using the vendor patch or distribution packages.
- Apply the Debian DSA-4924, Fedora, or NetApp advisories for the affected packaged versions.
- Restrict proxy access to trusted networks or authenticated users where feasible to reduce exposure.
- Monitor proxy availability and restart behavior for signs of repeated crashes pending patching.
Detection
- Alert on Squid process crashes or restarts correlated with HTTP Range request traffic.
- Inspect proxy logs for abnormal volumes of Range requests from single clients or source IPs.
- Monitor memory and CPU spikes on Squid hosts that coincide with Range request bursts.
- Track upstream advisories and package versions to confirm patched Squid builds are deployed.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
4 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-31806 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-31806), CISA KEV, FIRST EPSS (scores of 2026-09-22). This page is refreshed as NVD updates the record.
