CVE-2009-2855: Squid-Cache Squid

Medium severity, CVSS 5.0. EPSS: 34% chance of exploitation in the next 30 days.

The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.

Affected products

• Squid-Cache Squid: version 2.7 only

Published 2009-08-18. Last modified 2026-06-16.