Is CVE-2020-15810 actively exploited?

CVE-2020-15810 has no public evidence of in-the-wild exploitation as of 2024-11-21.

What is the CVSS score for CVE-2020-15810?

CVE-2020-15810 has a CVSS score of 6.5 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

How do I patch CVE-2020-15810?

Patch guidance is available from squid-cache security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2020-15810.

CVE-2020-15810 - remediation guidance & executive summary

Q: Which products are affected by CVE-2020-15810?

12 products: squid-cache squid, squid-cache squid, canonical ubuntu linux, canonical ubuntu linux, canonical ubuntu linux, and 7 more.

Description

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the proxy cache and any downstream caches with content from an arbitrary source. When configured for relaxed header parsing (the default), Squid relays headers containing whitespace characters to upstream servers. When this occurs as a prefix to a Content-Length header, the frame length specified will be ignored by Squid (allowing for a conflicting length to be used from another Content-Length header) but relayed upstream.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector: network
Complexity: low
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
Weaknesses: CWE-444

Metadata

Primary Vendor: SQUID-CACHE
Published: 9/2/2020
Last Modified: 11/21/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

squid-cache : squidsquid-cache : squidcanonical : ubuntu_linuxcanonical : ubuntu_linuxcanonical : ubuntu_linuxdebian : debian_linuxdebian : debian_linuxfedoraproject : fedorafedoraproject : fedorafedoraproject : fedoraopensuse : leapopensuse : leap

Remediation Guidance

Executive Summary

Cite this page

CVE-2020-15810. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2020-15810

View on NIST NVD

CVE-2020-15810 vulnerability