CVE-2015-5400

Squid before 3.5.6 does not properly handle CONNECT method peer responses when configured with cache_peer, which allows remote attackers to bypass intended restrictions and gain access to a backend proxy via a CONNECT request.

• CWE-264

• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.debian.org/security/2015/dsa-3327
• http://www.openwall.com/lists/oss-security/2015/07/06/8
• http://www.openwall.com/lists/oss-security/2015/07/09/12
• http://www.openwall.com/lists/oss-security/2015/07/10/2
• http://www.openwall.com/lists/oss-security/2015/07/17/14Exploit
• http://www.securityfocus.com/bid/75553
• http://www.securitytracker.com/id/1032873
• http://www.squid-cache.org/Advisories/SQUID-2015_2.txtVendor Advisory
• http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patchExploit, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patchExploit, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patchExploit, Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-May/183598.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00040.html
• http://lists.opensuse.org/opensuse-updates/2016-08/msg00069.html
• http://www.debian.org/security/2015/dsa-3327
• http://www.openwall.com/lists/oss-security/2015/07/06/8
• http://www.openwall.com/lists/oss-security/2015/07/09/12
• http://www.openwall.com/lists/oss-security/2015/07/10/2
• http://www.openwall.com/lists/oss-security/2015/07/17/14Exploit
• http://www.securityfocus.com/bid/75553
• http://www.securitytracker.com/id/1032873
• http://www.squid-cache.org/Advisories/SQUID-2015_2.txtVendor Advisory
• http://www.squid-cache.org/Versions/v3/3.1/changesets/squid-3.1-10494.patchExploit, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patchExploit, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patchExploit, Vendor Advisory

Published

Sep 28, 2015

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5383Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers…
• CVE-2015-5384AxiomSL's Axiom Google Web Toolkit module 9.5.3 and earlier …
• CVE-2015-5386Siemens SICAM MIC devices with firmware before 2404 allow re…
• CVE-2015-5395Cross-site request forgery (CSRF) vulnerability in SOGo befo…8.8
• CVE-2015-5397Cross-site request forgery (CSRF) vulnerability in Joomla! 3…
• CVE-2015-5399Cross-site scripting (XSS) vulnerability in PHPVibe before 4…
• CVE-2015-5401Teradata Gateway before 15.00.03.02-1 and 15.10.x before 15.…
• CVE-2015-5402HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-5403HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-5404HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-5405HP Systems Insight Manager (SIM) before 7.5.0, as used in HP…
• CVE-2015-5406HP CentralView Fraud Risk Management 11.1, 11.2, and 11.3; C…