CVE-2018-1000027

The Squid Software Foundation Squid HTTP Caching Proxy version prior to version 4.0.23 contains a NULL Pointer Dereference vulnerability in HTTP Response X-Forwarded-For header processing that can result in Denial of Service to all clients of the proxy. This attack appear to be exploitable via Remote HTTP server responding with an X-Forwarded-For header to certain types of HTTP request. This vulnerability appears to have been fixed in 4.0.23 and later.

• CWE-476

• http://www.squid-cache.org/Advisories/SQUID-2018_2.txtPatch, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
• http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
• https://github.com/squid-cache/squid/pull/129/filesThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/02/msg00002.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3557-1/Third Party Advisory
• https://usn.ubuntu.com/4059-2/
• https://www.debian.org/security/2018/dsa-4122Third Party Advisory
• http://www.squid-cache.org/Advisories/SQUID-2018_2.txtPatch, Vendor Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
• http://www.squid-cache.org/Versions/v4/changesets/SQUID-2018_2.patchPatch, Vendor Advisory
• https://github.com/squid-cache/squid/pull/129/filesThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/02/msg00001.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2018/02/msg00002.htmlMailing List, Third Party Advisory
• https://usn.ubuntu.com/3557-1/Third Party Advisory
• https://usn.ubuntu.com/4059-2/
• https://www.debian.org/security/2018/dsa-4122Third Party Advisory

Published

Feb 9, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1000021GIT version 2.15.1 and earlier contains a Input Validation E…5
• CVE-2018-1000022Electrum Technologies GmbH Electrum Bitcoin Wallet version p…
• CVE-2018-1000023Bitpay/insight-api Insight-api version 5.0.0 and earlier con…
• CVE-2018-1000024The Squid Software Foundation Squid HTTP Caching Proxy versi…
• CVE-2018-1000025Jerome Gamez Firebase Admin SDK for PHP version from 3.2.0 t…
• CVE-2018-1000026Linux Linux kernel version at least v4.8 onwards, probably w…7.7
• CVE-2018-1000028Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, …
• CVE-2018-1000029mcholste Enterprise Log Search and Archive (ELSA) version re…
• CVE-2018-1000030Python 2.7.14 is vulnerable to a Heap-Buffer-Overflow as wel…3.6
• CVE-2018-1000031A heap-based buffer overflow exists in Info-Zip UnZip versio…
• CVE-2018-1000032A heap-based buffer overflow exists in Info-Zip UnZip versio…
• CVE-2018-1000033An out-of-bounds read exists in Info-Zip UnZip version 6.10c…