Vulnerability record · CVE-2021-33620 · published 28 May 2021
CVE-2021-33620: Squid improper input validation in HTTP response header causes DoS
Squid Cache · Squid
Squid before 4.15 and 5.x before 5.0.6 fails to properly validate an HTTP response header, allowing a remote server to trigger a denial of service that affects availability for all clients. The trigger header is one that can legitimately appear in normal HTTP traffic, so the flaw can be hit without any malicious intent by the server.
Description
Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent by the server.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityAvailability-only impact with a medium CVSS score, but a very high EPSS percentile and a trigger that occurs in normal HTTP traffic make it a realistic operational risk.
What it is
Squid before 4.15 and 5.x before 5.0.6 fails to properly validate an HTTP response header, allowing a remote server to trigger a denial of service that affects availability for all clients. The trigger header is one that can legitimately appear in normal HTTP traffic, so the flaw can be hit without any malicious intent by the server.
Impact
An attacker or even an ordinary upstream server can cause the Squid proxy to become unavailable to all clients, disrupting web access for every user behind it. There is no confidentiality or integrity impact; only availability is lost.
Attack surface
Reached over the network through an HTTP response returned to the Squid proxy, requiring the attacker to control or influence a server the proxy fetches from. The CVSS vector indicates low privileges (PR:L) and no user interaction (UI:N); no client-side action is needed.
Exploitation
Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.79583, 99.6th percentile), indicating strong predicted likelihood of exploitation. References include vendor patches and third-party advisories but no public exploit tags.
What to do
- Upgrade Squid to 4.15 or later, or 5.0.6 or later, applying the vendor changesets for the 4.x and 5.x branches.
- Apply the patched Squid packages from Debian and Fedora advisories if you rely on distribution builds.
- Restrict which upstream servers the proxy may contact where feasible, reducing exposure to untrusted origins.
- Monitor proxy availability and restart or fail over Squid instances if they become unresponsive.
Detection
- Alert on Squid process crashes, restarts, or sudden loss of proxy availability.
- Monitor Squid logs for repeated upstream fetch failures or abnormal response handling around the same origin.
- Track proxy response latency and error rates for spikes consistent with a DoS condition.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-33620 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-33620), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
