CVE-2013-1839

high · 7.8

The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.

7.8

CVSS

18.3%

EPSS (exploit prob.)

97th

EPSS percentile

2013-09-30

Published

AV:N/AC:L/Au:N/C:N/I:N/A:C

Weaknesses

CWE-20

Affected products

Vendor	Product	Affected versions
squid-cache	squid	3.2.0.1
squid-cache	squid	3.2.0.2
squid-cache	squid	3.2.0.3
squid-cache	squid	3.2.0.4
squid-cache	squid	3.2.0.5
squid-cache	squid	3.2.0.6
squid-cache	squid	3.2.0.7
squid-cache	squid	3.2.0.8
squid-cache	squid	3.2.0.9
squid-cache	squid	3.2.0.10
squid-cache	squid	3.2.0.11
squid-cache	squid	3.2.0.12
squid-cache	squid	3.2.0.13
squid-cache	squid	3.2.0.14
squid-cache	squid	3.2.0.15
squid-cache	squid	3.2.0.16
squid-cache	squid	3.2.0.17
squid-cache	squid	3.2.0.18
squid-cache	squid	3.2.0.19
squid-cache	squid	3.2.1
squid-cache	squid	3.2.2
squid-cache	squid	3.2.3
squid-cache	squid	3.2.4
squid-cache	squid	3.2.5
squid-cache	squid	3.2.6
squid-cache	squid	3.2.7
squid-cache	squid	3.2.8
squid-cache	squid	3.3.0
squid-cache	squid	3.3.0.2
squid-cache	squid	3.3.0.3
squid-cache	squid	3.3.1
squid-cache	squid	3.3.2

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2013-1839