CVE-2010-3072
CVE-2010-3072 is a medium-severity vulnerability in Squid-cache Squid with a CVSS 2.0 base score of 5.0. Its EPSS exploit-prediction score of 64% places it in the 99th percentile, indicating an elevated likelihood of exploitation.
Key facts
- Severity: Medium (CVSS 2.0 base score 5.0)
- EPSS exploit prediction: 64% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Squid-cache Squid
- Published:
- Last modified:
Description
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Frequently asked questions
- What is CVE-2010-3072?
- The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
- How severe is CVE-2010-3072?
- CVE-2010-3072 has a CVSS 2.0 base score of 5.0, rated medium severity.
- Is CVE-2010-3072 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 64% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2010-3072?
- CVE-2010-3072 primarily affects Squid-cache Squid. In total, 55 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2010-3072?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2010-3072 published?
- CVE-2010-3072 was published on 2010-09-20 and last updated on 2026-06-16.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047787.html
- http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047820.html
- http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html
- http://secunia.com/advisories/41298
- http://secunia.com/advisories/41477
- http://secunia.com/advisories/41534
- http://www.debian.org/security/2010/dsa-2111
- http://www.openwall.com/lists/oss-security/2010/09/05/2
- http://www.openwall.com/lists/oss-security/2010/09/07/7
- http://www.securityfocus.com/bid/42982
- http://www.squid-cache.org/Advisories/SQUID-2010_3.txt
- http://www.squid-cache.org/Versions/v3/3.0/changesets/squid-3.0-9189.patch
- http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10090.patch
- http://www.vupen.com/english/advisories/2010/2433
- https://bugzilla.redhat.com/show_bug.cgi?id=630444
Affected products (55)
- cpe:2.3:a:squid-cache:squid:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*
More vulnerabilities in Squid-cache Squid
- CVE-2025-62168 — Critical (CVSS 10.0): Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication…
- CVE-2020-15049 — Critical (CVSS 9.9): An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3. A Request…
- CVE-2020-11945 — Critical (CVSS 9.8): An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to…
- CVE-2019-12519 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling the tag esi:when when ESI is enabled, Squid calls…
- CVE-2019-12524 — Critical (CVSS 9.8): An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the…
- CVE-2019-12526 — Critical (CVSS 9.8): An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based buffer overflow.…