{"id":"CVE-2016-4554","details":"mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a \"header smuggling\" issue.","modified":"2026-04-10T03:52:22.789414Z","published":"2016-05-10T19:59:01.307Z","related":["MGASA-2016-0171","SUSE-SU-2016:2008-1","SUSE-SU-2016:2089-1","SUSE-SU-2016:2147-1"],"references":[{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html"},{"type":"WEB","url":"http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3625"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2995-1"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1139"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201607-01"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1035769"},{"type":"ADVISORY","url":"http://www.squid-cache.org/Advisories/SQUID-2016_8.txt"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1140"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2016:1138"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2016_8.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.3/changesets/SQUID-2016_8.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_8.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2016_8.patch"},{"type":"FIX","url":"http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_8.patch"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/squid-cache/squid","events":[{"introduced":"0"},{"last_affected":"0a4efb98f1e84bb7392c7ecc9c7deb0381458b0f"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"3.5.17"}]}}],"versions":["HISTORIC_RELEASES","SQUID_3_0_PRE1","SQUID_3_0_PRE2","SQUID_3_0_PRE3","SQUID_3_0_PRE4","SQUID_3_0_PRE5","SQUID_3_0_PRE6","SQUID_3_0_PRE7","SQUID_3_0_RC1","SQUID_3_5_0_1","SQUID_3_5_0_2","SQUID_3_5_0_3","SQUID_3_5_0_4","SQUID_3_5_1","SQUID_3_5_10","SQUID_3_5_11","SQUID_3_5_12","SQUID_3_5_13","SQUID_3_5_14","SQUID_3_5_15","SQUID_3_5_16","SQUID_3_5_17","SQUID_3_5_2","SQUID_3_5_3","SQUID_3_5_4","SQUID_3_5_5","SQUID_3_5_6","SQUID_3_5_7","SQUID_3_5_8","SQUID_3_5_9","take00"],"database_specific":{"unresolved_ranges":[{"events":[{"introduced":"0"},{"last_affected":"6"}]},{"events":[{"introduced":"0"},{"last_affected":"7"}]},{"events":[{"introduced":"0"},{"last_affected":"12.04"}]},{"events":[{"introduced":"0"},{"last_affected":"14.04"}]},{"events":[{"introduced":"0"},{"last_affected":"15.10"}]},{"events":[{"introduced":"0"},{"last_affected":"16.04"}]}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4554.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"}]}