CVE catalog

CVE-2019-12529

squid affected and fixed versions

An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.x through 3.5.28, and 4.x through 4.7. When Squid is configured to use Basic Authentication, the Proxy-Authorization header is parsed via uudecode. uudecode determines how many bytes will be decoded by iterating over the input and checking its table. The length is then used to start decoding the string. There are no checks to ensure that the length it calculates isn't greater than the input buffer. This leads to adjacent memory being decoded as well. An attacker would not be able to retrieve the decoded data unless the Squid maintainer had configured the display of usernames on error pages.

Severity: Medium · CVSS 4.3CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Published: Jul 11, 2019, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 8.09% · Oct 27, 2026

Projects and upstream resources

[squid][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	squid	`6.13-2+deb13u2`	Fixed	[CVE-2019-12529]
Debiantrixie	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debiantrixie	squid	`6.13-2+deb13u3`	Fixed	[CVE-2019-12529]
Debiansid	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debiansid	squid	`7.7-1`	Fixed	[CVE-2019-12529]
Debianforky	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debianforky	squid	`7.7-1`	Fixed	[CVE-2019-12529]
Debianbookworm-security	squid	`5.7-2+deb12u6`	Fixed	[CVE-2019-12529]
Debianbookworm	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debianbookworm	squid	`5.7-2+deb12u5`	Fixed	[CVE-2019-12529]

Showing 10 fix observations. All 30 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Alpine3.10	squid	`4.8-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2019-12529]Sep 21, 2026, 6:17:52 AM UTC
Alpine3.9	squid	`4.8-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2019-12529]Sep 21, 2026, 6:17:52 AM UTC
Debianbookworm	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debianbookworm	squid	`5.7-2+deb12u5`	Fixed	[CVE-2019-12529]
Debianbookworm-security	squid	`5.7-2+deb12u6`	Fixed	[CVE-2019-12529]
Debianforky	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debianforky	squid	`7.7-1`	Fixed	[CVE-2019-12529]
Debiansid	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debiansid	squid	`7.7-1`	Fixed	[CVE-2019-12529]
Debiantrixie	squid	`4.8-1`	FixedDistribution-reported fixed boundary	[CVE-2019-12529]
Debiantrixie	squid	`6.13-2+deb13u3`	Fixed	[CVE-2019-12529]
Debiantrixie-security	squid	`6.13-2+deb13u2`	Fixed	[CVE-2019-12529]
Ubuntu16.04	squid3	`3.3.8-1ubuntu16`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.3.8-1ubuntu17`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu6`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.5`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.6`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.7`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu16.04	squid3	`3.5.12-1ubuntu7.8`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.23-5ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.23-5ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.27-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.27-1ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.27-1ubuntu1.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC
Ubuntu18.04	squid3	`3.5.27-1ubuntu1.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2019-12529]Feb 4, 2026, 4:18:26 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "squid",
      "status": "fixed",
      "release": "sid",
      "version": "7.7-1"
    },
    {
      "name": "squid",
      "status": "fixed",
      "release": "forky",
      "version": "7.7-1"
    },
    {
      "name": "squid",
      "status": "fixed",
      "release": "trixie",
      "version": "6.13-2+deb13u3"
    },
    {
      "name": "squid",
      "status": "fixed",
      "release": "trixie-security",
      "version": "6.13-2+deb13u2"
    },
    {
      "name": "squid",
      "status": "fixed",
      "release": "bookworm",
      "version": "5.7-2+deb12u5"
    },
    {
      "name": "squid",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "5.7-2+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "squid",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "4.8-1"
    },
    {
      "bug": null,
      "name": "squid",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "4.8-1"
    },
    {
      "bug": null,
      "name": "squid",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "4.8-1"
    },
    {
      "bug": null,
      "name": "squid",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "4.8-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "squid",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.0"
            },
            {
              "fixed": "4.8-r0"
            }
          ]
        }
      ],
      "release": "3.10",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2019-12529",
      "fixed_version": "4.8-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2019-12529",
      "provider_updated_at": "2026-09-21T06:17:52.466083372Z",
      "applicability_unknown": true
    },
    {
      "name": "squid",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "2.0"
            },
            {
              "fixed": "4.8-r0"
            }
          ]
        }
      ],
      "release": "3.9",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2019-12529",
      "fixed_version": "4.8-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2019-12529",
      "provider_updated_at": "2026-09-21T06:17:52.466083372Z",
      "applicability_unknown": true
    },
    {
      "name": "squid3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.12-1ubuntu7.8"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "3.3.8-1ubuntu16",
        "3.3.8-1ubuntu17",
        "3.5.12-1ubuntu6",
        "3.5.12-1ubuntu7",
        "3.5.12-1ubuntu7.1",
        "3.5.12-1ubuntu7.2",
        "3.5.12-1ubuntu7.3",
        "3.5.12-1ubuntu7.4",
        "3.5.12-1ubuntu7.5",
        "3.5.12-1ubuntu7.6",
        "3.5.12-1ubuntu7.7"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-12529",
      "fixed_version": "3.5.12-1ubuntu7.8",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-12529",
      "provider_updated_at": "2026-02-04T04:18:26.370989Z",
      "applicability_unknown": true
    },
    {
      "name": "squid3",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.5.27-1ubuntu1.3"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.5.23-5ubuntu1",
        "3.5.23-5ubuntu2",
        "3.5.27-1ubuntu1",
        "3.5.27-1ubuntu1.1",
        "3.5.27-1ubuntu1.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2019-12529",
      "fixed_version": "3.5.27-1ubuntu1.3",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2019-12529",
      "provider_updated_at": "2026-02-04T04:18:26.370989Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[squid]Unknown
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
[squid-cgi]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
[squidclient]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
[squid-common]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · all · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · all · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
[squid-openssl]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
[squid-purge]Unknown
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · bookworm; dsa · squid · debian · 12

[Debian 13 (Trixie)]

[squid]Unknown
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
[squid-cgi]Unknown
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
[squidclient]Unknown
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
[squid-common]Unknown
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · all · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
[squid-openssl]Unknown
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
[squid-purge]Unknown
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Fixed · Fixed: 4.8-1
  dsa · squid · debian · 13

Observed: Oct 23, 2026, 5:39:42 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]