PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-10003 Squid Cache CVE debrief

Squid HTTP Proxy versions 3.5.0.1-3.5.22 and 4.0.1-4.0.16 can mis-handle HTTP request header comparison in the Collapsed Forwarding feature, causing some private responses to be treated as suitable for delivery to multiple clients. Because the issue is network-reachable, requires no privileges or user interaction, and can expose confidential content, affected proxy deployments should be prioritized for upgrade to fixed releases.

Vendor
Squid Cache
Product
Squid
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-27
Original CVE updated
2026-05-13
Advisory published
2017-01-27
Advisory updated
2026-05-13

Who should care

Operators and administrators of affected Squid HTTP Proxy deployments, especially environments that use Collapsed Forwarding and handle sensitive or private content.

Technical summary

NVD describes this as an incorrect HTTP request header comparison issue in Squid's Collapsed Forwarding feature. The affected ranges are Squid 3.5.0.1 through 3.5.22 and 4.0.1 through 4.0.16, with fixes indicated by the NVD version boundaries at 3.5.23 and 4.0.17. The recorded CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely reachable confidentiality exposure with no required privileges or user interaction. NVD classifies the weakness under CWE-697.

Defensive priority

High. This is a remotely reachable confidentiality issue with no authentication or user interaction required, so impacted Squid instances should be upgraded promptly, with priority for deployments serving sensitive content.

Recommended defensive actions

  • Upgrade Squid to a fixed release: 3.5.23 or later, or 4.0.17 or later.
  • Inventory all Squid instances to confirm whether they fall within the affected version ranges and whether Collapsed Forwarding is in use.
  • If immediate upgrading is not possible, follow the vendor advisory's mitigation guidance and reduce exposure of affected proxy paths until patched.
  • Validate the upgrade in staging and then deploy across all proxy nodes to avoid inconsistent behavior in clustered or distributed environments.

Evidence notes

This debrief is based only on the supplied CVE description, NVD metadata, and the linked vendor/mailing-list references present in the corpus. The version ranges, CVSS vector, and CWE classification come from the NVD record; the external reference pages themselves were not fetched here, so mitigation detail is intentionally limited to the evidence available in the supplied record.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-10003 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-10003

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-10003 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-10003

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.