CVE catalog

CVE-2016-2569

squid: CVE-2016-2569

Severity: High · CVSS 7.5CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Feb 27, 2016, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 31.19% · Oct 25, 2026

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	squid	sid	`7.7-1`	not affected
Debian	squid	forky	`7.7-1`	not affected
Debian	squid	trixie	`6.13-2+deb13u3`	not affected
Debian	squid	trixie-security	`6.13-2+deb13u2`	not affected
Debian	squid	bookworm	`5.7-2+deb12u5`	not affected
Debian	squid	bookworm-security	`5.7-2+deb12u6`	not affected
Ubuntu	squid3	14.04	`3.3.8-1ubuntu3`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu4`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu5`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.1`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.2`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.3`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.4`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.6`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.8`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.9`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.10`	vulnerable
Ubuntu	squid3	14.04	`3.3.8-1ubuntu6.11`	fixed
Ubuntu	squid3	16.04	`3.3.8-1ubuntu16`	vulnerable
Ubuntu	squid3	16.04	`3.3.8-1ubuntu17`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu6`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.1`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.2`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.3`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.4`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.5`	fixed
Ubuntu	squid3	16.04	`3.3.8-1ubuntu16`	vulnerable
Ubuntu	squid3	16.04	`3.3.8-1ubuntu17`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu6`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.1`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.2`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.3`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.4`	vulnerable
Ubuntu	squid3	16.04	`3.5.12-1ubuntu7.5`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	squid	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	squid	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	squid	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	squid	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Ubuntu	squid3	deb	14.04	`3.3.8-1ubuntu6.11`	Not reported	USN-3557-1	Not reported
Ubuntu	squid3	deb	16.04	`3.5.12-1ubuntu7.5`	Not reported	USN-3557-1	Not reported
Ubuntu	squid3	deb	16.04	`3.5.12-1ubuntu7.5`	Not reported	UBUNTU-CVE-2016-2569	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[squid]Unknown
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · arm64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
[squid-cgi]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · arm64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
[squidclient]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · arm64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
[squid-common]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · all · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · all · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · all · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · all · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
[squid-openssl]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · arm64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
[squid-purge]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u5 · arm64 · bookworm
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Not affected
  dsa · squid · debian · bookworm

Observed: Oct 23, 2026, 5:20:25 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]