https://megamansec.github.io/Squid-Security-Audit/

Squid-Security-Audit

Squid Caching Proxy Security Audit: 55 vulnerabilities and 35 0days

In February 2021, I started looking for vulnerabilities in
forward-proxies, and found various issues in Squid. Some more
information about what's here can be found on my blog: https://
joshua.hu/squid-security-audit-35-0days-45-exploits

Explanations and reproducers for each of the vulnerabilities are
documented in each of the markdown files. IDs are assigned where
possible, however since the majority of these remain unfixed, there
are no identifiers.

                  Vulnerability                           ID
Stack Buffer Overflow in Digest Authentication     
Use-After-Free in TRACE Requests                   
Partial Content Parsing Use-After-Free            CVE-2021-31807
X-Forwarded-For Stack Overflow                     
Chunked Encoding Stack Overflow                    
Use-After-Free in Cache Manager Errors             
Cache Poisoning by Large Stored Response Headers   
(With Bonus XSS)
Memory Leak in CacheManager URI Parsing           CVE-2021-28652
RFC 2141 / 2169 (URN) Response Parsing Memory     CVE-2021-28651
Leak
Memory Leak in HTTP Response Parsing               
Memory Leak in ESI Error Processing                
1-Byte Buffer OverRead in RFC 1123 date/time       
Handling
Null Pointer Dereference in Gopher Response       GHSA-cg5h-v6vc-w33f
Handling
One-Byte Buffer OverRead in HTTP Request Header    
Parsing
strlen(NULL) Crash Using Digest Authentication     
Assertion in ESI Header Handling                   
Integer Overflow in Range Header                  CVE-2021-31808
Gopher Assertion Crash                             
Whois Assertion Crash                              
Assertion in Gopher Response Handling              
RFC 2141 / 2169 (URN) Assertion Crash              
Vary: Other HTTP Response Assertion Crash         CVE-2021-28662
Assertion in Negotiate/NTLM Authentication Using   
Pipeline Prefetching
Assertion on IPv6 Host Requests with               
-disable-ipv6
Assertion Crash on Unexpected "HTTP/1.1 100        
Continue" Response Header
Pipeline Prefetch Assertion With Double            
'Expect:100-continue' Request Headers
Pipeline Prefetch Assertion With Invalid Headers   
Assertion Crash in Deferred Requests               
Assertion in Digest Authentication                 
FTP URI Assertion                                  
FTP Authentication Crash                           
Unsatisfiable Range Requests Assertion            CVE-2021-31806
Crash in Content-Range Response Header Logic      CVE-2021-33620
Assertion Crash In HTTP Response Headers Handling  
Implicit Assertion in Stream Handling              
Buffer UnderRead in SSL CN Parsing                 
Use-After-Free in ESI 'Try' (and 'Choose')         
Processing
Use-After-Free in ESI Expression Evaluation        
Buffer Underflow in ESI                            
Assertion in Squid "Helper" Process Creator        
Assertion Due to 0 ESI 'when' Checking             
Assertion Using ESI's When Directive               
Assertion in ESI Variable Assignment (String)      
Assertion in ESI Variable Assignment               
Null Pointer Dereference In ESI's esi:include and  
esi:when