CVE-2016-2570

The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP…

published February 27, 2016

CVSS
—
EPSS
9%
Percentile
95.2
In the wild
Unconfirmed
What it is

The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP servers to cause a denial of service (assertion failure and daemon exit) via a crafted XML document, related to esi/CustomParser.cc and esi/CustomParser.h.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08953 · 95.2th percentile
Published
2016-02-27T02:00Z
EPSS history
Timeline
  • 27 FEB 02:00Z
    The Edge Side Includes (ESI) parser in Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not check buffer limits during XML parsing, which allows remote HTTP…
    cvelistv5