CVE-2016-2569

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.

Published: 2016-02-27 Last update: 2026-05-06 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2016-2569 is rated Moderate Risk (64.1/100): CVSS High severity, with high exploitation likelihood (EPSS 70.32%, 99th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2016-2569

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-02-23 70.73% 70.32% -0.42%
2 2026-02-18 71.40% 70.73% -0.67%
3 2025-12-28 — 71.40% —

Full EPSS history (31 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2016-2569

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.0 HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 3.9 3.6 [email protected]
5.0 2.0 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 10.0 2.9 [email protected]

Weakness enumeration for CVE-2016-2569

OS Trackers for CVE-2016-2569

vendor priority summary link
debian unimportant CVE-2016-2569 unimportant priority: Debian including 1 source packages (squid), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2016-2569
gentoo normal CVE-2016-2569: 1 GLSA(s) (201607-01), 1 atom(s) (net-proxy/squid); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2016-2569
redhat medium — https://access.redhat.com/security/cve/CVE-2016-2569
suse high CVE-2016-2569 severity important: SUSE including 247 source package names (amazon/suse-sles-15-sp1-chost-byos-v20210304-hvm-ssd-x86_64, amazon/suse-sles-15-sp1-chost-byos-v20220127-hvm-ssd-x86_64, …), 276 product×package rows across 41 product lines (HPE Helion OpenStack 8, SUSE CaaS Platform 4.0, … (41 product lines)): Known Affected 231, Known Not Affected 23, Fixed 22. https://www.suse.com/security/cve/CVE-2016-2569/
ubuntu low CVE-2016-2569 low priority: Ubuntu including 1 source packages (squid3), 8 status rows across 8 suites (artful, precise, trusty, upstream, wily, xenial, yakkety, zesty): ignored 4, released 2, DNE 1, not-affected 1. https://ubuntu.com/security/CVE-2016-2569

Affected software / configurations for CVE-2016-2569

Vendor Product Version Raw CPE
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:*:*:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre1:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre2:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre3:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre4:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre5:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre6:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:-:pre7:*:*:*:*:*
squid-cache squid 3.0 cpe:2.3:a:squid-cache:squid:3.0:rc4:*:*:*:*:*:*
squid-cache squid 3.0.stable1 cpe:2.3:a:squid-cache:squid:3.0.stable1:*:*:*:*:*:*:*
squid-cache squid 3.0.stable2 cpe:2.3:a:squid-cache:squid:3.0.stable2:*:*:*:*:*:*:*
squid-cache squid 3.0.stable3 cpe:2.3:a:squid-cache:squid:3.0.stable3:*:*:*:*:*:*:*
squid-cache squid 3.0.stable4 cpe:2.3:a:squid-cache:squid:3.0.stable4:*:*:*:*:*:*:*
squid-cache squid 3.0.stable5 cpe:2.3:a:squid-cache:squid:3.0.stable5:*:*:*:*:*:*:*
squid-cache squid 3.0.stable6 cpe:2.3:a:squid-cache:squid:3.0.stable6:*:*:*:*:*:*:*
squid-cache squid 3.0.stable7 cpe:2.3:a:squid-cache:squid:3.0.stable7:*:*:*:*:*:*:*
squid-cache squid 3.0.stable8 cpe:2.3:a:squid-cache:squid:3.0.stable8:*:*:*:*:*:*:*
squid-cache squid 3.0.stable9 cpe:2.3:a:squid-cache:squid:3.0.stable9:*:*:*:*:*:*:*
squid-cache squid 3.0.stable10 cpe:2.3:a:squid-cache:squid:3.0.stable10:*:*:*:*:*:*:*
squid-cache squid 3.0.stable11 cpe:2.3:a:squid-cache:squid:3.0.stable11:*:*:*:*:*:*:*
squid-cache squid 3.0.stable11 cpe:2.3:a:squid-cache:squid:3.0.stable11:rc1:*:*:*:*:*:*
squid-cache squid 3.0.stable12 cpe:2.3:a:squid-cache:squid:3.0.stable12:*:*:*:*:*:*:*
squid-cache squid 3.0.stable13 cpe:2.3:a:squid-cache:squid:3.0.stable13:*:*:*:*:*:*:*
squid-cache squid 3.0.stable14 cpe:2.3:a:squid-cache:squid:3.0.stable14:*:*:*:*:*:*:*
squid-cache squid 3.0.stable15 cpe:2.3:a:squid-cache:squid:3.0.stable15:*:*:*:*:*:*:*
squid-cache squid 3.0.stable16 cpe:2.3:a:squid-cache:squid:3.0.stable16:*:*:*:*:*:*:*
squid-cache squid 3.0.stable16 cpe:2.3:a:squid-cache:squid:3.0.stable16:rc1:*:*:*:*:*:*
squid-cache squid 3.0.stable17 cpe:2.3:a:squid-cache:squid:3.0.stable17:*:*:*:*:*:*:*
squid-cache squid 3.0.stable18 cpe:2.3:a:squid-cache:squid:3.0.stable18:*:*:*:*:*:*:*
squid-cache squid 3.0.stable19 cpe:2.3:a:squid-cache:squid:3.0.stable19:*:*:*:*:*:*:*
squid-cache squid 3.0.stable20 cpe:2.3:a:squid-cache:squid:3.0.stable20:*:*:*:*:*:*:*
squid-cache squid 3.0.stable21 cpe:2.3:a:squid-cache:squid:3.0.stable21:*:*:*:*:*:*:*
squid-cache squid 3.0.stable22 cpe:2.3:a:squid-cache:squid:3.0.stable22:*:*:*:*:*:*:*
squid-cache squid 3.0.stable23 cpe:2.3:a:squid-cache:squid:3.0.stable23:*:*:*:*:*:*:*
squid-cache squid 3.0.stable24 cpe:2.3:a:squid-cache:squid:3.0.stable24:*:*:*:*:*:*:*
squid-cache squid 3.0.stable25 cpe:2.3:a:squid-cache:squid:3.0.stable25:*:*:*:*:*:*:*
squid-cache squid 3.1 cpe:2.3:a:squid-cache:squid:3.1:*:*:*:*:*:*:*
squid-cache squid 3.1.0.1 cpe:2.3:a:squid-cache:squid:3.1.0.1:*:*:*:*:*:*:*
squid-cache squid 3.1.0.2 cpe:2.3:a:squid-cache:squid:3.1.0.2:*:*:*:*:*:*:*
squid-cache squid 3.1.0.3 cpe:2.3:a:squid-cache:squid:3.1.0.3:*:*:*:*:*:*:*
squid-cache squid 3.1.0.4 cpe:2.3:a:squid-cache:squid:3.1.0.4:*:*:*:*:*:*:*
squid-cache squid 3.1.0.5 cpe:2.3:a:squid-cache:squid:3.1.0.5:*:*:*:*:*:*:*
squid-cache squid 3.1.0.6 cpe:2.3:a:squid-cache:squid:3.1.0.6:*:*:*:*:*:*:*
squid-cache squid 3.1.0.7 cpe:2.3:a:squid-cache:squid:3.1.0.7:*:*:*:*:*:*:*
squid-cache squid 3.1.0.8 cpe:2.3:a:squid-cache:squid:3.1.0.8:*:*:*:*:*:*:*
squid-cache squid 3.1.0.9 cpe:2.3:a:squid-cache:squid:3.1.0.9:*:*:*:*:*:*:*
squid-cache squid 3.1.0.10 cpe:2.3:a:squid-cache:squid:3.1.0.10:*:*:*:*:*:*:*
squid-cache squid 3.1.0.11 cpe:2.3:a:squid-cache:squid:3.1.0.11:*:*:*:*:*:*:*
squid-cache squid 3.1.0.12 cpe:2.3:a:squid-cache:squid:3.1.0.12:*:*:*:*:*:*:*
squid-cache squid 3.1.0.13 cpe:2.3:a:squid-cache:squid:3.1.0.13:*:*:*:*:*:*:*
squid-cache squid 3.1.0.14 cpe:2.3:a:squid-cache:squid:3.1.0.14:*:*:*:*:*:*:*
squid-cache squid 3.1.0.15 cpe:2.3:a:squid-cache:squid:3.1.0.15:*:*:*:*:*:*:*
squid-cache squid 3.1.0.16 cpe:2.3:a:squid-cache:squid:3.1.0.16:*:*:*:*:*:*:*
squid-cache squid 3.1.0.17 cpe:2.3:a:squid-cache:squid:3.1.0.17:*:*:*:*:*:*:*
squid-cache squid 3.1.0.18 cpe:2.3:a:squid-cache:squid:3.1.0.18:*:*:*:*:*:*:*
squid-cache squid 3.1.1 cpe:2.3:a:squid-cache:squid:3.1.1:*:*:*:*:*:*:*
squid-cache squid 3.1.2 cpe:2.3:a:squid-cache:squid:3.1.2:*:*:*:*:*:*:*
squid-cache squid 3.1.3 cpe:2.3:a:squid-cache:squid:3.1.3:*:*:*:*:*:*:*
squid-cache squid 3.1.4 cpe:2.3:a:squid-cache:squid:3.1.4:*:*:*:*:*:*:*
squid-cache squid 3.1.5 cpe:2.3:a:squid-cache:squid:3.1.5:*:*:*:*:*:*:*
squid-cache squid 3.1.5.1 cpe:2.3:a:squid-cache:squid:3.1.5.1:*:*:*:*:*:*:*
squid-cache squid 3.1.6 cpe:2.3:a:squid-cache:squid:3.1.6:*:*:*:*:*:*:*
squid-cache squid 3.1.7 cpe:2.3:a:squid-cache:squid:3.1.7:*:*:*:*:*:*:*
squid-cache squid 3.1.8 cpe:2.3:a:squid-cache:squid:3.1.8:*:*:*:*:*:*:*
squid-cache squid 3.1.9 cpe:2.3:a:squid-cache:squid:3.1.9:*:*:*:*:*:*:*
squid-cache squid 3.1.10 cpe:2.3:a:squid-cache:squid:3.1.10:*:*:*:*:*:*:*
squid-cache squid 3.1.11 cpe:2.3:a:squid-cache:squid:3.1.11:*:*:*:*:*:*:*
squid-cache squid 3.1.12 cpe:2.3:a:squid-cache:squid:3.1.12:*:*:*:*:*:*:*
squid-cache squid 3.1.13 cpe:2.3:a:squid-cache:squid:3.1.13:*:*:*:*:*:*:*
squid-cache squid 3.1.14 cpe:2.3:a:squid-cache:squid:3.1.14:*:*:*:*:*:*:*
squid-cache squid 3.1.15 cpe:2.3:a:squid-cache:squid:3.1.15:*:*:*:*:*:*:*
squid-cache squid 3.2.0.1 cpe:2.3:a:squid-cache:squid:3.2.0.1:*:*:*:*:*:*:*
squid-cache squid 3.2.0.2 cpe:2.3:a:squid-cache:squid:3.2.0.2:*:*:*:*:*:*:*
squid-cache squid 3.2.0.3 cpe:2.3:a:squid-cache:squid:3.2.0.3:*:*:*:*:*:*:*
squid-cache squid 3.2.0.4 cpe:2.3:a:squid-cache:squid:3.2.0.4:*:*:*:*:*:*:*
squid-cache squid 3.2.0.5 cpe:2.3:a:squid-cache:squid:3.2.0.5:*:*:*:*:*:*:*
squid-cache squid 3.2.0.6 cpe:2.3:a:squid-cache:squid:3.2.0.6:*:*:*:*:*:*:*
squid-cache squid 3.2.0.7 cpe:2.3:a:squid-cache:squid:3.2.0.7:*:*:*:*:*:*:*
squid-cache squid 3.2.0.8 cpe:2.3:a:squid-cache:squid:3.2.0.8:*:*:*:*:*:*:*
squid-cache squid 3.2.0.9 cpe:2.3:a:squid-cache:squid:3.2.0.9:*:*:*:*:*:*:*

References for CVE-2016-2569

cvelogic Threat Intelligence