CVE-2019-18677

An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.

• CWE-352

• http://www.squid-cache.org/Advisories/SQUID-2019_9.txtThird Party Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patchRelease Notes
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patchRelease Notes
• https://bugzilla.suse.com/show_bug.cgi?id=1156328Issue Tracking, Third Party Advisory
• https://github.com/squid-cache/squid/pull/427Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
• https://usn.ubuntu.com/4213-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682
• http://www.squid-cache.org/Advisories/SQUID-2019_9.txtThird Party Advisory
• http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-e5f1813a674848dde570f7920873e1071f96e0b4.patchRelease Notes
• http://www.squid-cache.org/Versions/v4/changesets/squid-4-36492033ea4097821a4f7ff3ddcb971fbd1e8ba0.patchRelease Notes
• https://bugzilla.suse.com/show_bug.cgi?id=1156328Issue Tracking, Third Party Advisory
• https://github.com/squid-cache/squid/pull/427Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2019/12/msg00011.htmlThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/
• https://usn.ubuntu.com/4213-1/Third Party Advisory
• https://www.debian.org/security/2020/dsa-4682

Published

Nov 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-18671Insufficient checks in the USB packet handling of the ShapeS…9.8
• CVE-2019-18672Insufficient checks in the finite state machine of the Shape…7.5
• CVE-2019-18673On SHIFT BitBox02 devices, a side channel for the row-based …4.6
• CVE-2019-18674An issue was discovered in Joomla! before 3.9.13. A missing …5.3
• CVE-2019-18675The Linux kernel through 5.3.13 has a start_offset+size Inte…7.8
• CVE-2019-18676An issue was discovered in Squid 3.x and 4.x through 4.8. Du…7.5
• CVE-2019-18678An issue was discovered in Squid 3.x and 4.x through 4.8. It…5.3
• CVE-2019-18679An issue was discovered in Squid 2.x, 3.x, and 4.x through 4…7.5
• CVE-2019-1868A vulnerability in the web-based management interface of Cis…7.5
• CVE-2019-18680An issue was discovered in the Linux kernel 4.4.x before 4.4…7.5
• CVE-2019-18683An issue was discovered in drivers/media/platform/vivid in t…7
• CVE-2019-18684Sudo through 1.8.29 allows local users to escalate to root i…7