CVE-2021-28662: Debian Linux

Medium severity, CVSS 6.5. EPSS: 71.8% chance of exploitation in the next 30 days.

An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Squid-Cache Squid: from 4.0.1, before 4.15 (fixed in 4.15); from 5.0, before 5.0.6 (fixed in 5.0.6)

Published 2021-05-27. Last modified 2026-06-17.