CVE catalog

CVE-2020-25097

squid: CVE-2020-25097

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
7.34% · Oct 25, 2026

An issue was discovered in Squid through 4.13 and 5.x through 5.0.4. Due to improper input validation, it allows a trusted client to perform HTTP Request Smuggling and access services otherwise forbidden by the security controls. This occurs for certain uri_whitespace configuration settings.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansquidsid7.7-1fixed
Debiansquidforky7.7-1fixed
Debiansquidtrixie6.13-2+deb13u3fixed
Debiansquidtrixie-security6.13-2+deb13u2fixed
Debiansquidbookworm5.7-2+deb12u5fixed
Debiansquidbookworm-security5.7-2+deb12u6fixed
Alpinesquid3.104.14-r0fixed
Alpinesquid3.114.14-r0fixed
Alpinesquid3.124.14-r0fixed
Alpinesquid3.135.0.5-r0fixed
Alpinesquid3.145.0.5-r0fixed
Alpinesquid3.155.0.5-r0fixed
Alpinesquid3.165.0.5-r0fixed
Alpinesquid3.175.0.5-r0fixed
Alpinesquid3.185.0.5-r0fixed
Alpinesquid3.195.0.5-r0fixed
Alpinesquid3.205.0.5-r0fixed
Alpinesquid3.215.0.5-r0fixed
Alpinesquid3.225.0.5-r0fixed
Alpinesquid3.235.0.5-r0fixed
Alpinesquid3.245.0.5-r0fixed
Susesquid3linux enterprise point of sale 11 sp33.1.23-8.16.37.18.1fixed
Susesquid3linux enterprise server 11 sp4-ltss3.1.23-8.16.37.18.1fixed
Susesquidopenstack cloud 93.5.21-26.35.1fixed
Susesquidopenstack cloud crowbar 93.5.21-26.35.1fixed
Susesquidlinux enterprise server for sap applications 12 sp43.5.21-26.35.1fixed
Susesquidlinux enterprise server 12 sp2-bcl3.5.21-26.35.1fixed
Susesquidlinux enterprise server 12 sp3-bcl3.5.21-26.35.1fixed
Susesquidlinux enterprise server 12 sp4-ltss3.5.21-26.35.1fixed
Ubuntusquid316.043.3.8-1ubuntu16vulnerable
Ubuntusquid316.043.3.8-1ubuntu17vulnerable
Ubuntusquid316.043.5.12-1ubuntu6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.1vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.2vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.3vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.4vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.5vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.6vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.7vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.8vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.9vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.10vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.11vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.12vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.13vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.14vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.15vulnerable
Ubuntusquid316.043.5.12-1ubuntu7.16fixed
Ubuntusquid318.043.5.23-5ubuntu1vulnerable
Ubuntusquid318.043.5.23-5ubuntu2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.1vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.2vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.3vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.4vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.5vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.6vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.7vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.8vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.9vulnerable
Ubuntusquid318.043.5.27-1ubuntu1.10fixed
Ubuntusquid20.044.8-1ubuntu2vulnerable
Ubuntusquid20.044.8-1ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu1vulnerable
Ubuntusquid20.044.9-2ubuntu2vulnerable
Ubuntusquid20.044.9-2ubuntu3vulnerable
Ubuntusquid20.044.9-2ubuntu4vulnerable
Ubuntusquid20.044.10-1ubuntu1vulnerable
Ubuntusquid20.044.10-1ubuntu1.1vulnerable
Ubuntusquid20.044.10-1ubuntu1.2vulnerable
Ubuntusquid20.044.10-1ubuntu1.3fixed
Susesquidlinux enterprise module for server applications 15 sp24.15-5.26.1fixed
Susesquidlinux enterprise module for server applications 15 sp34.15-5.26.1fixed
Susesquidlinux enterprise high performance computing 15-espos4.15-5.26.1fixed
Susesquidlinux enterprise high performance computing 15-ltss4.15-5.26.1fixed
Susesquidlinux enterprise high performance computing 15 sp1-espos4.15-5.26.1fixed
Susesquidlinux enterprise high performance computing 15 sp1-ltss4.15-5.26.1fixed
Susesquidlinux enterprise server 15-ltss4.15-5.26.1fixed
Susesquidlinux enterprise server 15 sp1-bcl4.15-5.26.1fixed
Susesquidlinux enterprise server 15 sp1-ltss4.15-5.26.1fixed
Susesquidlinux enterprise server for sap applications 154.15-5.26.1fixed
Susesquidlinux enterprise server for sap applications 15 sp14.15-5.26.1fixed
Susesquidmanager proxy 4.04.15-5.26.1fixed
Susesquidmanager retail branch server 4.04.15-5.26.1fixed
Susesquidmanager server 4.04.15-5.26.1fixed
Susesquidenterprise storage 64.15-5.26.1fixed
Opensusesquidleap 15.24.15-lp152.2.9.1fixed
Opensusesquidleap 15.34.15-5.26.1fixed
Susesquidlinux enterprise server 12 sp54.15-4.18.1fixed
Susesquidlinux enterprise server for sap applications 12 sp54.15-4.18.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansquidsourcesid4.13-8not yet assignedNot reported[985068]
Debiansquidsourceforky4.13-8not yet assignedNot reported[985068]
Debiansquidsourcetrixie4.13-8not yet assignedNot reported[985068]
Debiansquidsourcebookworm4.13-8not yet assignedNot reported[985068]
Alpinesquidapk3.104.14-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.114.14-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.124.14-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.135.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.145.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.155.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.165.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.175.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.185.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.195.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.205.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.215.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.225.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.235.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Alpinesquidapk3.245.0.5-r0Not reportedALPINE-CVE-2020-25097Not reported
Susesquid3rpmlinux enterprise point of sale 11 sp33.1.23-8.16.37.18.1Not reportedSUSE-SU-2022:14914-1Not reported
Susesquid3rpmlinux enterprise server 11 sp4-ltss3.1.23-8.16.37.18.1Not reportedSUSE-SU-2022:14914-1Not reported
Susesquidrpmopenstack cloud 93.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Susesquidrpmopenstack cloud crowbar 93.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp43.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Susesquidrpmlinux enterprise server 12 sp2-bcl3.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Susesquidrpmlinux enterprise server 12 sp3-bcl3.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Susesquidrpmlinux enterprise server 12 sp4-ltss3.5.21-26.35.1Not reportedSUSE-SU-2022:2392-1Not reported
Ubuntusquid3deb16.043.5.12-1ubuntu7.16Not reportedUBUNTU-CVE-2020-25097Not reported
Ubuntusquid3deb18.043.5.27-1ubuntu1.10Not reportedUBUNTU-CVE-2020-25097Not reported
Ubuntusquiddeb20.044.10-1ubuntu1.3Not reportedUBUNTU-CVE-2020-25097Not reported
Susesquidrpmlinux enterprise module for server applications 15 sp24.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise module for server applications 15 sp34.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise high performance computing 15-espos4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise high performance computing 15-ltss4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise high performance computing 15 sp1-espos4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise high performance computing 15 sp1-ltss4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server 15-ltss4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server 15 sp1-bcl4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server 15 sp1-ltss4.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server for sap applications 154.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server for sap applications 15 sp14.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmmanager proxy 4.04.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmmanager retail branch server 4.04.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmmanager server 4.04.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Susesquidrpmenterprise storage 64.15-5.26.1Not reportedSUSE-SU-2021:1961-1Not reported
Opensusesquidrpmleap 15.24.15-lp152.2.9.1Not reportedOPENSUSE-SU-2021:0879-1Not reported
Opensusesquidrpmleap 15.34.15-5.26.1Not reportedOPENSUSE-SU-2021:1961-1Not reported
Susesquidrpmlinux enterprise server 12 sp54.15-4.18.1Not reportedSUSE-SU-2021:1838-1Not reported
Susesquidrpmlinux enterprise server for sap applications 12 sp54.15-4.18.1Not reportedSUSE-SU-2021:1838-1Not reported

[Debian bug #985068]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [squid]Unknown
    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-cgi]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squidclient]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-common]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · all · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · all · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · all · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · all · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-openssl]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

  • [squid-purge]Unknown

    Source package: [squid]

    Details (4)
    • 5.7-2+deb12u5 · amd64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u5 · arm64 · bookworm

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · amd64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

    • 5.7-2+deb12u6 · arm64 · bookworm-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · bookworm; dsa · squid · debian · 12

[Debian 13 (Trixie)]

  • [squid]Unknown
    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

  • [squid-cgi]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

  • [squidclient]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

  • [squid-common]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · all · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · all · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

  • [squid-openssl]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

  • [squid-purge]Unknown

    Source package: [squid]

    Details (4)
    • 6.13-2+deb13u2 · amd64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · amd64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

    • 6.13-2+deb13u2 · arm64 · trixie-security

      Fixed · Fixed: 4.13-8

      dsa · squid · debian · 13

Observed:

References