CVE catalog

CVE-2019-12519

squid: CVE-2019-12519

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
6.72% · Oct 25, 2026

An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls ESIExpression::Evaluate. This function uses a fixed stack buffer to hold the expression while it's being evaluated. When processing the expression, it could either evaluate the top of the stack, or add a new member to the stack. When adding a new member, there is no check to ensure that the stack won't overflow.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansquidsid7.7-1fixed
Debiansquidforky7.7-1fixed
Debiansquidtrixie6.13-2+deb13u3fixed
Debiansquidtrixie-security6.13-2+deb13u2fixed
Debiansquidbookworm5.7-2+deb12u5fixed
Debiansquidbookworm-security5.7-2+deb12u6fixed
Alpinesquid3.104.11-r0fixed
Alpinesquid3.114.11-r0fixed
Alpinesquid3.94.11-r0fixed
Ubuntusquid316.043.3.8-1ubuntu16vulnerable
Ubuntusquid316.043.3.8-1ubuntu17vulnerable
Ubuntusquid316.043.5.12-1ubuntu6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.1vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.2vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.3vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.4vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.5vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.8vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.9vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.10vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.11fixed
Ubuntusquid318.043.5.23-5ubuntu1vulnerable
Ubuntusquid318.043.5.23-5ubuntu2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.3vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.4vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.5vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.6fixed
Ubuntusquid20.044.8-1ubuntu2vulnerable
Ubuntusquid20.044.8-1ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu1vulnerable
Ubuntusquid20.044.9-2ubuntu2vulnerable
Ubuntusquid20.044.9-2ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu4vulnerable
Ubuntusquid20.044.10-1ubuntu1vulnerable
Ubuntusquid20.044.10-1ubuntu1.1fixed
Susesquidhpe helion openstack 83.5.21-26.23.1fixed
Susesquidopenstack cloud 73.5.21-26.23.1fixed
Susesquidopenstack cloud 83.5.21-26.23.1fixed
Susesquidopenstack cloud crowbar 83.5.21-26.23.1fixed
Susesquidlinux enterprise server for sap applications 12 sp23.5.21-26.23.1fixed
Susesquidlinux enterprise server for sap applications 12 sp33.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp2-ltss3.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp2-bcl3.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp3-ltss3.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp3-bcl3.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp43.5.21-26.23.1fixed
Susesquidlinux enterprise server for sap applications 12 sp43.5.21-26.23.1fixed
Susesquidenterprise storage 53.5.21-26.23.1fixed
Susesquidlinux enterprise server 12 sp54.11-4.9.1fixed
Susesquidlinux enterprise server for sap applications 12 sp54.11-4.9.1fixed
Ubuntusquid316.043.3.8-1ubuntu16vulnerable
Ubuntusquid316.043.3.8-1ubuntu17vulnerable
Ubuntusquid316.043.5.12-1ubuntu6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.1vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.2vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.3vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.4vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.5vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.8vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.9vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.10vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.11fixed
Ubuntusquid318.043.5.23-5ubuntu1vulnerable
Ubuntusquid318.043.5.23-5ubuntu2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.3vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.4vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.5vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.6fixed
Ubuntusquid20.044.8-1ubuntu2vulnerable
Ubuntusquid20.044.8-1ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu1vulnerable
Ubuntusquid20.044.9-2ubuntu2vulnerable
Ubuntusquid20.044.9-2ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu4vulnerable
Ubuntusquid20.044.10-1ubuntu1vulnerable
Ubuntusquid20.044.10-1ubuntu1.1fixed
Opensusesquidleap 15.14.11-lp151.2.15.2fixed
Susesquidlinux enterprise module for server applications 15 sp14.11-5.17.2fixed
Susesquidlinux enterprise high performance computing 15-espos4.11-5.17.2fixed
Susesquidlinux enterprise high performance computing 15-ltss4.11-5.17.2fixed
Susesquidlinux enterprise server 15-ltss4.11-5.17.2fixed
Susesquidlinux enterprise server for sap applications 154.11-5.17.2fixed
Susesquid3linux enterprise point of sale 11 sp33.1.23-8.16.37.12.1fixed
Susesquid3linux enterprise server 11 sp4-ltss3.1.23-8.16.37.12.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansquidsourcesid4.11-1not yet assignedNot reportedNot reported
Debiansquidsourceforky4.11-1not yet assignedNot reportedNot reported
Debiansquidsourcetrixie4.11-1not yet assignedNot reportedNot reported
Debiansquidsourcebookworm4.11-1not yet assignedNot reportedNot reported
Alpinesquidapk3.104.11-r0Not reportedALPINE-CVE-2019-12519Not reported
Alpinesquidapk3.114.11-r0Not reportedALPINE-CVE-2019-12519Not reported
Alpinesquidapk3.94.11-r0Not reportedALPINE-CVE-2019-12519Not reported
Ubuntusquid3deb16.043.5.12-1ubuntu7.11Not reportedUSN-4356-1Not reported
Ubuntusquid3deb18.043.5.27-1ubuntu1.6Not reportedUSN-4356-1Not reported
Ubuntusquiddeb20.044.10-1ubuntu1.1Not reportedUSN-4356-1Not reported
Susesquidrpmhpe helion openstack 83.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmopenstack cloud 73.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmopenstack cloud 83.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmopenstack cloud crowbar 83.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp23.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp33.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp2-ltss3.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp2-bcl3.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp3-ltss3.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp3-bcl3.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp43.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp43.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmenterprise storage 53.5.21-26.23.1Not reportedSUSE-SU-2020:1227-1Not reported
Susesquidrpmlinux enterprise server 12 sp54.11-4.9.1Not reportedSUSE-SU-2020:1134-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp54.11-4.9.1Not reportedSUSE-SU-2020:1134-1Not reported
Ubuntusquid3deb16.043.5.12-1ubuntu7.11Not reportedUBUNTU-CVE-2019-12519Not reported
Ubuntusquid3deb18.043.5.27-1ubuntu1.6Not reportedUBUNTU-CVE-2019-12519Not reported
Ubuntusquiddeb20.044.10-1ubuntu1.1Not reportedUBUNTU-CVE-2019-12519Not reported
Opensusesquidrpmleap 15.14.11-lp151.2.15.2Not reportedOPENSUSE-SU-2020:0623-1Not reported
Susesquidrpmlinux enterprise module for server applications 15 sp14.11-5.17.2Not reportedSUSE-SU-2020:1156-1Not reported
Susesquidrpmlinux enterprise high performance computing 15-espos4.11-5.17.2Not reportedSUSE-SU-2020:1156-1Not reported
Susesquidrpmlinux enterprise high performance computing 15-ltss4.11-5.17.2Not reportedSUSE-SU-2020:1156-1Not reported
Susesquidrpmlinux enterprise server 15-ltss4.11-5.17.2Not reportedSUSE-SU-2020:1156-1Not reported
Susesquidrpmlinux enterprise server for sap applications 154.11-5.17.2Not reportedSUSE-SU-2020:1156-1Not reported
Susesquid3rpmlinux enterprise point of sale 11 sp33.1.23-8.16.37.12.1Not reportedSUSE-SU-2020:14460-1Not reported
Susesquid3rpmlinux enterprise server 11 sp4-ltss3.1.23-8.16.37.12.1Not reportedSUSE-SU-2020:14460-1Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [squid]Unknown
    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-cgi]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squidclient]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-common]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · all · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · all · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · all · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · all · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-openssl]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-purge]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

[Debian 13 (Trixie)]

  • [squid]Unknown
    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

  • [squid-cgi]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

  • [squidclient]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

  • [squid-common]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · all · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

  • [squid-openssl]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

  • [squid-purge]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.11-1

      dsa · squid · debian · 13

Observed:

References