CVE-2005-0174
MediumSquid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3)…
Published Feb 7, 2005 · Updated Aug 4, 2026 · Also known as DEBIAN-CVE-2005-0174
Key Facts
Patch immediately- CVE-2005-0174 is a medium-severity vulnerability (CVSS 5.0 v2) affecting Squid.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 50% probability of exploitation in the next 30 days.
- Fixed versions are available, including Squid 2.5.7-6, Squid 7:2.5.STABLE6-3.4E.3.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v2
5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
EPSS (30-day exploit likelihood)
50%
Higher than 98.9% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2005-0174 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace characters.
Affected Products
28 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SquidSquid | 2.5.6, 2.5.stable1, 2.5_.stable1, 2.5.stable2, 2.5.stable3, 2.5_stable3, 2.5_.stable3, 2.5.stable4 | 2.5.7-6 |
Patched Releases
Squid
2.5.7-6, 7:2.5.STABLE6-3.4E.3
Timeline
Publicly disclosed
Feb 7, 2005
Last updated
Aug 4, 2026
References
- advisoryCLA-2005:931
- advisoryRHSA-2005:060
- advisoryRHSA-2005:061
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2005-0174
- advisoryVU#768702
FAQ
Common Questions.
Squid 2.5 up to 2.5.STABLE7 allows remote attackers to poison the cache or conduct certain attacks via headers that do not follow the HTTP specification, including (1) multiple Content-Length headers, (2) carriage return (CR) characters that are not part of a CRLF pair, and (3) header names containing whitespace chara…
Affected: Squid versions 2.5.6, 2.5.stable1, 2.5_.stable1, 2.5.stable2, 2.5.stable3, 2.5_stable3, 2.5_.stable3, 2.5.stable4. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Squid 2.5.7-6, Squid 7:2.5.STABLE6-3.4E.3.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2005-0174 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo