CVE-2021-31807

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. An integer overflow problem allows a remote server to achieve Denial of Service when delivering responses to HTTP Range requests. The issue trigger is a header that can be expected to exist in HTTP traffic without any malicious intent.

Published: 2021-06-08 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2021-31807 is rated Moderate Risk (54.8/100): CVSS Medium severity, with high exploitation likelihood (EPSS 15.97%, 96th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2021-31807

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 33.71% 15.97% -17.74%
2 2026-01-16 33.80% 33.71% -0.09%
3 2025-12-31 — 33.80% —

Full EPSS history (36 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2021-31807

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
6.5 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:N)
Data isn’t meaningfully altered or forged.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 2.8 3.6 [email protected]
4.0 2.0 MEDIUM
AV:N/AC:L/Au:S/C:N/I:N/A:P Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:L)
Exploitation conditions are straightforward and predictable.
Authentication (AU:S)
A single authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:N)
No integrity impact.
Availability impact (A:P)
Partial availability impact.
 8.0 2.9 [email protected]

Weakness enumeration for CVE-2021-31807

OS Trackers for CVE-2021-31807

vendor priority summary link
alpine medium CVE-2021-31807: 1 source package rows (squid); 45 state rows across 10 repos (3.10-main, 3.11-main, 3.12-main, 3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 10, open 35. https://security.alpinelinux.org/vuln/CVE-2021-31807
debian not yet assigned CVE-2021-31807 not yet assigned priority: Debian including 1 source packages (squid), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2021-31807
gentoo normal CVE-2021-31807: 1 GLSA(s) (202105-14), 1 atom(s) (net-proxy/squid); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2021-31807
redhat medium — https://access.redhat.com/security/cve/CVE-2021-31807
suse medium — https://www.suse.com/security/cve/CVE-2021-31807/
ubuntu medium CVE-2021-31807 medium priority: Ubuntu including 2 source packages (squid, squid3), 32 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 16, released 14, needed 1, needs-triage 1. https://ubuntu.com/security/CVE-2021-31807

Affected software / configurations for CVE-2021-31807

Vendor Product Version Raw CPE
squid-cache squid >= 3.0, < 4.15 cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
squid-cache squid >= 5.0, < 5.0.6 cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
squid-cache squid 2.5.stable2 cpe:2.3:a:squid-cache:squid:2.5.stable2:*:*:*:*:*:*:*
squid-cache squid 2.5.stable3 cpe:2.3:a:squid-cache:squid:2.5.stable3:*:*:*:*:*:*:*
squid-cache squid 2.5.stable4 cpe:2.3:a:squid-cache:squid:2.5.stable4:*:*:*:*:*:*:*
squid-cache squid 2.5.stable5 cpe:2.3:a:squid-cache:squid:2.5.stable5:*:*:*:*:*:*:*
squid-cache squid 2.5.stable6 cpe:2.3:a:squid-cache:squid:2.5.stable6:*:*:*:*:*:*:*
squid-cache squid 2.5.stable7 cpe:2.3:a:squid-cache:squid:2.5.stable7:*:*:*:*:*:*:*
squid-cache squid 2.5.stable8 cpe:2.3:a:squid-cache:squid:2.5.stable8:*:*:*:*:*:*:*
squid-cache squid 2.5.stable9 cpe:2.3:a:squid-cache:squid:2.5.stable9:*:*:*:*:*:*:*
squid-cache squid 2.5.stable10 cpe:2.3:a:squid-cache:squid:2.5.stable10:*:*:*:*:*:*:*
squid-cache squid 2.5.stable11 cpe:2.3:a:squid-cache:squid:2.5.stable11:*:*:*:*:*:*:*
squid-cache squid 2.5.stable12 cpe:2.3:a:squid-cache:squid:2.5.stable12:*:*:*:*:*:*:*
squid-cache squid 2.5.stable13 cpe:2.3:a:squid-cache:squid:2.5.stable13:*:*:*:*:*:*:*
squid-cache squid 2.5.stable14 cpe:2.3:a:squid-cache:squid:2.5.stable14:*:*:*:*:*:*:*
squid-cache squid 2.6 cpe:2.3:a:squid-cache:squid:2.6:*:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:-:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable2:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable3:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable4:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable5:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable6:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable7:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable8:*:*:*:*:*:*
squid-cache squid 2.7 cpe:2.3:a:squid-cache:squid:2.7:stable9:*:*:*:*:*:*
fedoraproject fedora 33 cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraproject fedora 34 cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
netapp cloud_manager — cpe:2.3:a:netapp:cloud_manager:-:*:*:*:*:*:*:*

References for CVE-2021-31807

URL Tags
http://seclists.org/fulldisclosure/2023/Oct/14 Mailing List Third Party Advisory
http://www.openwall.com/lists/oss-security/2023/10/11/3 Mailing List Third Party Advisory
http://www.squid-cache.org/Versions/v4/changesets/squid-4-e7cf864f938f24eea8af0692c04d16790983c823.patch Patch Vendor Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-pxwq-f3qr-w2xf Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/06/msg00014.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSQ3U54ZCNXR44QRPW3AV2VCS6K3TKCF/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4EPIWUZDJAXADDHVOPKRBTQHPBR6H66/
https://security.netapp.com/advisory/ntap-20210716-0007/ Third Party Advisory
cvelogic Threat Intelligence