CVE-2019-12524

An issue was discovered in Squid through 4.7. When handling requests from users, Squid checks its rules to see if the request should be denied. Squid by default comes with rules to block access to the Cache Manager, which serves detailed server information meant for the maintainer. This rule is implemented via url_regex. The handler for url_regex rules URL decodes an incoming request. This allows an attacker to encode their URL to bypass the url_regex check, and gain access to the blocked resource.

• CWE-306

• https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txtThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210205-0006/Third Party Advisory
• https://usn.ubuntu.com/4446-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682Third Party Advisory
• https://gitlab.com/jeriko.one/security/-/blob/master/squid/CVEs/CVE-2019-12524.txtThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210205-0006/Third Party Advisory
• https://usn.ubuntu.com/4446-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682Third Party Advisory

Published

Apr 15, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12519An issue was discovered in Squid through 4.7. When handling …9.8
• CVE-2019-1252An information disclosure vulnerability exists when the Wind…6.5
• CVE-2019-12520An issue was discovered in Squid through 4.7 and 5. When rec…7.5
• CVE-2019-12521An issue was discovered in Squid through 4.7. When Squid is …5.9
• CVE-2019-12522An issue was discovered in Squid through 4.7. When Squid is …4.5
• CVE-2019-12523An issue was discovered in Squid before 4.9. When handling a…9.1
• CVE-2019-12525An issue was discovered in Squid 3.3.9 through 3.5.28 and 4.…9.8
• CVE-2019-12526An issue was discovered in Squid before 4.9. URN response ha…9.8
• CVE-2019-12527An issue was discovered in Squid 4.0.23 through 4.7. When ch…8.8
• CVE-2019-12528An issue was discovered in Squid before 4.10. It allows a cr…7.5
• CVE-2019-12529An issue was discovered in Squid 2.x through 2.7.STABLE9, 3.…5.9
• CVE-2019-1253An elevation of privilege vulnerability exists when the Wind…7.8