Medium
Security advisory
An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-18677
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 11:02 UTC · Revision 1
Source evidence
An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.
osv:CVE-2019-18677
Complete source record
{
"id": "9cea1e105ffef70259f52b34adf6641a6308a4809a4bcfac034909da068a9720",
"url": "https://osv.dev/vulnerability/CVE-2019-18677",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-18677",
"summary": "An issue was discovered in Squid 3.x and 4.x through 4.8 when the append_domain setting is used (because the appended characters do not properly interact with hostname length restrictions). Due to incorrect message processing, it can inappropriately redirect traffic to origins it should not be delivered to.",
"evidence": "osv:CVE-2019-18677",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-18677",
"aliases": [
"CVE-2019-18677"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/squid-cache/squid",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "6cfeb300caf423ff49a0511d8bd43a56f3418273"
},
{
"last_affected": "fede82b3e7aa1f12a91bade17f6ac0d4c7463e0a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.0"
},
{
"last_affected": "3.5.28"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "4.0"
},
{
"last_affected": "4.8"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"SQUID_4_8",
"SQUID_4_7",
"SQUID_4_6",
"SQUID_4_5",
"SQUID_4_4",
"SQUID_3_5_28",
"SQUID_4_3",
"SQUID_4_2",
"SQUID_4_1",
"SQUID_4_0_25",
"SQUID_4_0_24",
"SQUID_4_0_23",
"SQUID_4_0_22",
"SQUID_4_0_21",
"SQUID_3_5_26",
"SQUID_4_0_20",
"SQUID_3_5_25",
"SQUID_4_0_19",
"SQUID_3_5_24",
"SQUID_4_0_18",
"SQUID_3_5_23",
"SQUID_4_0_17",
"SQUID_4_0_16",
"SQUID_3_5_22",
"SQUID_4_0_15",
"SQUID_3_5_21",
"SQUID_4_0_14",
"SQUID_4_0_13",
"SQUID_3_5_20",
"SQUID_4_0_12",
"SQUID_4_0_11",
"SQUID_3_5_19",
"SQUID_4_0_10",
"SQUID_3_5_18",
"SQUID_3_5_17",
"SQUID_4_0_9",
"SQUID_3_5_16",
"SQUID_4_0_8",
"SQUID_3_5_15",
"SQUID_4_0_7",
"SQUID_3_5_14",
"SQUID_4_0_6",
"SQUID_4_0_5",
"SQUID_3_5_13",
"SQUID_4_0_4",
"SQUID_3_5_12",
"SQUID_4_0_3",
"SQUID_3_5_11",
"SQUID_4_0_2",
"SQUID_4_0_1",
"SQUID_3_5_10",
"SQUID_3_5_9",
"SQUID_3_5_8",
"SQUID_3_5_7",
"SQUID_3_5_6",
"SQUID_3_5_5",
"SQUID_3_5_4",
"SQUID_3_5_3",
"SQUID_3_5_2",
"SQUID_3_5_1",
"SQUID_3_5_0_4",
"SQUID_3_5_0_3",
"SQUID_3_5_0_2",
"SQUID_3_5_0_1",
"take00",
"SQUID_3_0_RC1",
"SQUID_3_0_PRE7",
"SQUID_3_0_PRE6",
"SQUID_3_0_PRE5",
"SQUID_3_0_PRE4",
"SQUID_3_0_PRE3",
"SQUID_3_0_PRE2",
"SQUID_3_0_PRE1",
"HISTORIC_RELEASES"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-18677.json"
}
}
],
"modified": "2026-10-20T10:52:30.061147435Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2020/07/msg00009.html",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MTM74TU2BSLT5B3H4F3UDW53672NVLMC/",
"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UEMOYTMCCFWK5NOXSXEIH5D2VGWVXR67/",
"https://lists.debian.org/debian-lts-announce/2019/12/msg00011.html",
"https://usn.ubuntu.com/4213-1/",
"https://www.debian.org/security/2020/dsa-4682",
"https://bugzilla.suse.com/show_bug.cgi?id=1156328",
"https://github.com/squid-cache/squid/pull/427"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*"
],
"vendor_product": "squid-cache:squid",
"extracted_events": [
{
"range": [
{
"introduced": "2.0"
},
{
"last_affected": "2.7"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
},
{
"introduced": "18.04"
},
{
"last_affected": "18.04"
},
{
"introduced": "19.04"
},
{
"last_affected": "19.04"
},
{
"introduced": "19.10"
},
{
"last_affected": "19.10"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
],
"vendor_product": "fedoraproject:fedora",
"extracted_events": [
{
"range": [
{
"introduced": "30"
},
{
"last_affected": "30"
},
{
"introduced": "31"
},
{
"last_affected": "31"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*",
"cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*"
],
"vendor_product": "squid-cache:squid",
"extracted_events": [
{
"range": [
{
"introduced": "2.7-stable2"
},
{
"last_affected": "2.7-stable2"
},
{
"introduced": "2.7-stable3"
},
{
"last_affected": "2.7-stable3"
},
{
"introduced": "2.7-stable4"
},
{
"last_affected": "2.7-stable4"
},
{
"introduced": "2.7-stable5"
},
{
"last_affected": "2.7-stable5"
},
{
"introduced": "2.7-stable6"
},
{
"last_affected": "2.7-stable6"
},
{
"introduced": "2.7-stable7"
},
{
"last_affected": "2.7-stable7"
},
{
"introduced": "2.7-stable8"
},
{
"last_affected": "2.7-stable8"
},
{
"introduced": "2.7-stable9"
},
{
"last_affected": "2.7-stable9"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-18677",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 383670,
"published_at": "2019-11-26T17:15:12.923+00:00"
}