CVE-2007-6239
CVE-2007-6239 is a medium-severity vulnerability in Squid Squid Web Proxy Cache with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 27% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-20.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 27% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-20
- Affected product: Squid Squid Web Proxy Cache
- Published:
- Last modified:
Description
The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
Frequently asked questions
- What is CVE-2007-6239?
- The "cache update reply processing" functionality in Squid 2.x before 2.6.STABLE17 and Squid 3.0 allows remote attackers to cause a denial of service (crash) via unknown vectors related to HTTP headers and an Array memory leak during requests for cached objects.
- How severe is CVE-2007-6239?
- CVE-2007-6239 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2007-6239 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 27% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2007-6239?
- CVE-2007-6239 primarily affects Squid Squid Web Proxy Cache. In total, 38 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2007-6239?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2007-6239 published?
- CVE-2007-6239 was published on 2007-12-04 and last updated on 2026-06-16.
References
- http://bugs.gentoo.org/show_bug.cgi?id=201209
- http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
- http://secunia.com/advisories/27910
- http://secunia.com/advisories/28091
- http://secunia.com/advisories/28109
- http://secunia.com/advisories/28350
- http://secunia.com/advisories/28381
- http://secunia.com/advisories/28403
- http://secunia.com/advisories/28412
- http://secunia.com/advisories/28814
- http://secunia.com/advisories/34467
- http://security.gentoo.org/glsa/glsa-200801-05.xml
- http://security.gentoo.org/glsa/glsa-200903-38.xml
- http://www.debian.org/security/2008/dsa-1482
- http://www.kb.cert.org/vuls/id/232881
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:002
- http://www.redhat.com/support/errata/RHSA-2007-1130.html
- http://www.securityfocus.com/bid/26687
- http://www.securitytracker.com/id?1019036
- http://www.squid-cache.org/Advisories/SQUID-2007_2.txt
- http://www.squid-cache.org/Versions/v2/2.6/changesets/11780.patch
- http://www.ubuntu.com/usn/usn-565-1
- http://www.vupen.com/english/advisories/2007/4066
- https://bugzilla.redhat.com/show_bug.cgi?id=410181
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10915
- https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00497.html
- https://www.redhat.com/archives/fedora-package-announce/2007-December/msg00507.html
Affected products (38)
- cpe:2.3:a:squid:squid_web_proxy_cache:2.0_patch2:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.1_patch2:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.3.stable5:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable2:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable6:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.4_stable7:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable11:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable12:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable13:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5.stable14:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_.stable9:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable1:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable3:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable5:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable6:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable7:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable8:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.5_stable10:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable1:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable2:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable3:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable5:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable6:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable7:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable12:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable13:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable14:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable15:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:2.6.stable16:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre1:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre2:*:*:*:*:*:*:*
- cpe:2.3:a:squid:squid_web_proxy_cache:3.0_pre3:*:*:*:*:*:*:*
More vulnerabilities in Squid Squid Web Proxy Cache
- CVE-2009-0801 — Medium (CVSS 5.4): Squid, when transparent interception mode is enabled, uses the HTTP Host header to determine the remote endpoint, which…
All CVEs affecting Squid Squid Web Proxy Cache →
Other CWE-20 (Improper Input Validation) vulnerabilities
- CVE-2026-48316 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48281 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48277 — Critical (CVSS 10.0): ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Input Validation vulnerability that could…
- CVE-2026-48055 — Critical (CVSS 10.0): Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and…
- CVE-2026-34910 — Critical (CVSS 10.0): A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS…
- CVE-2026-33587 — Critical (CVSS 10.0): Lack of user input sanitisation in Open Notebook v1.8.3 allows the application user to execute Python code (and…
Browse all CWE-20 (Improper Input Validation) vulnerabilities →