CVE-2020-15811

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-697

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Sep 2, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-158138.1Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. TheCVE-2020-158168.8In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute cCVE-2020-158178.8In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2020-158185.3In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.CVE-2020-158195.3JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.CVE-2020-15827.8A remote code execution vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An aCVE-2020-158205.3In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.CVE-2020-158216.5In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.CVE-2020-158227.3In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.CVE-2020-158237.5JetBrains YouTrack before 2020.2.8873 is vulnerable to SSRF in the Workflow component.CVE-2020-158248.8In JetBrains Kotlin from 1.4-M1 to 1.4-RC (as Kotlin 1.3.7x is not affected by the issue. Fixed version is 1.4.0) there is a script-cache prCVE-2020-158258.8In JetBrains TeamCity before 2020.1, users with the Modify Group permission can elevate other users' privileges.
CVE-2020-15811: Medium severity, CVSS 6.5 | Vulnix