CVE-2016-2390: Squid-Cache Squid

Medium severity, CVSS 5.9. EPSS: 25.6% chance of exploitation in the next 30 days.

The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.

Affected products

• Squid-Cache Squid: up to and including 3.5.13; version 4.0.4 only; version 4.0.5 only

Published 2016-04-19. Last modified 2026-06-17.