PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10003 Squid Cache CVE debrief

Squid HTTP Proxy versions 3.5.0.1-3.5.22 and 4.0.1-4.0.16 can mis-handle HTTP request header comparison in the Collapsed Forwarding feature, causing some private responses to be treated as suitable for delivery to multiple clients. Because the issue is network-reachable, requires no privileges or user interaction, and can expose confidential content, affected proxy deployments should be prioritized for upgrade to fixed releases.

Vendor
Squid Cache
Product
CVE-2016-10003
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Operators and administrators of affected Squid HTTP Proxy deployments, especially environments that use Collapsed Forwarding and handle sensitive or private content.

Technical summary

NVD describes this as an incorrect HTTP request header comparison issue in Squid's Collapsed Forwarding feature. The affected ranges are Squid 3.5.0.1 through 3.5.22 and 4.0.1 through 4.0.16, with fixes indicated by the NVD version boundaries at 3.5.23 and 4.0.17. The recorded CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely reachable confidentiality exposure with no required privileges or user interaction. NVD classifies the weakness under CWE-697.

Defensive priority

High. This is a remotely reachable confidentiality issue with no authentication or user interaction required, so impacted Squid instances should be upgraded promptly, with priority for deployments serving sensitive content.

Recommended defensive actions

  • Upgrade Squid to a fixed release: 3.5.23 or later, or 4.0.17 or later.
  • Inventory all Squid instances to confirm whether they fall within the affected version ranges and whether Collapsed Forwarding is in use.
  • If immediate upgrading is not possible, follow the vendor advisory's mitigation guidance and reduce exposure of affected proxy paths until patched.
  • Validate the upgrade in staging and then deploy across all proxy nodes to avoid inconsistent behavior in clustered or distributed environments.

Evidence notes

This debrief is based only on the supplied CVE description, NVD metadata, and the linked vendor/mailing-list references present in the corpus. The version ranges, CVSS vector, and CWE classification come from the NVD record; the external reference pages themselves were not fetched here, so mitigation detail is intentionally limited to the evidence available in the supplied record.

Official resources

CVE-2016-10003 was publicly published in the CVE/NVD record on 2017-01-27, with the supplied record later modified on 2026-05-13. The reference set indicates both mailing-list and vendor-advisory disclosure/patch context.