CVE-2020-24606

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted…

High · published August 24, 2020

CVSS v3.1
8.6
EPSS
5%
Percentile
92.2
In the wild
Unconfirmed
What it is

Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted Cache Digest response message. This only occurs when cache_peer is used with the cache digests feature. The problem exists because peerDigestHandleReply() livelocking in peer_digest.cc mishandles EOF.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AC:L/AV:N/A:H/C:N/I:N/PR:N/S:C/UI:N
CVSS v4.0
Not supplied
EPSS
0.04961 · 92.2th percentile
Published
2020-08-24T17:06Z
EPSS history
Timeline
  • 24 AUG 17:06Z
    Squid before 4.13 and 5.x before 5.0.4 allows a trusted peer to perform Denial of Service by consuming all available CPU cycles during handling of a crafted…
    cvelistv5