CVE-2021-31808

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-190

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
May 27, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-31816.5rfc822.c in Mutt through 2.0.4 allows remote attackers to cause a denial of service (mailbox unavailability) by sending email messages with CVE-2021-318105.8An issue was discovered in Ruby through 2.6.7, 2.7.x through 2.7.3, and 3.x through 3.0.1. A malicious FTP server can use the PASV response CVE-2021-318115.5In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBoxCVE-2021-318125.5In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox versionCVE-2021-318135.4Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted userCVE-2021-318146.1In Stormshield 1.1.0, and 2.1.0 through 2.9.0, an attacker can block a client from accessing the VPN and can obtain sensitive information thCVE-2021-318153.3GAEN (aka Google/Apple Exposure Notifications) through 2021-04-27 on Android allows attackers to obtain sensitive information, such as a useCVE-2021-318167.5When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is writtenCVE-2021-318177.5When configuring Octopus Server if it is configured with an external SQL database, on initial configuration the database password is writtenCVE-2021-318184.3Affected versions of Octopus Server are prone to an authenticated SQL injection vulnerability in the Events REST API because user supplied dCVE-2021-318199.8In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already tCVE-2021-31828.0D-Link DCS-5220 devices have a buffer overflow. NOTE: This vulnerability only affects products that are no longer supported by the maintaine
CVE-2021-31808: Medium severity, CVSS 6.5 | Vulnix