An issue was discovered in Squid 4.x before 4.15 and 5.x before 5.0.6. If a remote server sends a certain response header over HTTP or HTTPS, there is a denial of service. This header can plausibly occur in benign network traffic.
{ "vanir_signatures": [ { "deprecated": false, "signature_type": "Line", "source": "https://github.com/squid-cache/squid/commit/051824924c709bd6162a378f746fb859454c674e", "signature_version": "v1", "target": { "file": "src/http/RegisteredHeaders.cc" }, "digest": { "threshold": 0.9, "line_hashes": [ "246787021619791419152269128153398552627", "137540088876487517479355767659710642705", "2037448173086037427154046699180625686", "111963318781500401476263553951823657637" ] }, "id": "CVE-2021-28662-ac67f9e9" }, { "deprecated": false, "signature_type": "Function", "source": "https://github.com/squid-cache/squid/commit/051824924c709bd6162a378f746fb859454c674e", "signature_version": "v1", "target": { "file": "src/http/RegisteredHeaders.cc", "function": "HeaderLookupTable_t::lookup" }, "digest": { "function_hash": "213594514490356346423760141520931754203", "length": 211.0 }, "id": "CVE-2021-28662-b5ea6bf5" } ] }