Cyber Resilience

CVE-2016-4553

Squid-Cache Squid ≤ 3.5.17

High EPSS
Published
10 May 2016
Modified
06 May 2026
Patch / advisory
CVSS Score v3 8.6
Click a component to see what it means
Raw vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N
EPSS Score 0.80 99.6th percentile
Risk Priority 85 floored blend · peak EPSS

Summary

CVE-2016-4553 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Squid-Cache Squid. Its CVSS base score is 8.6 (High).

Operationally, ranked in the top 0.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability allows remote attackers to poison the Squid cache by manipulating HTTP Host headers, directly enabling exploitation of a public-facing proxy service.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2016-4054Same product: Canonical Ubuntu Linux
CVE-2026-47333Same product: Canonical Ubuntu Linux
CVE-2023-2640Same product: Canonical Ubuntu Linux
CVE-2026-21991Same product: Oracle Linux
CVE-2026-33515Same product: Squid-Cache Squid
CVE-2024-23638Same product: Squid-Cache Squid
CVE-2026-32748Same product: Squid-Cache Squid
CVE-2026-21996Same product: Oracle Linux
CVE-2023-49285Same product: Squid-Cache Squid
CVE-2023-49286Same product: Squid-Cache Squid

Affected Assets

canonical
ubuntu linux
12.04, 14.04, 15.10, 16.04
squid-cache
squid
4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5 · ≤ 3.5.17
oracle
linux
7

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 8 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V3.5.5

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-345

Directly requires independent verification of matching output before adverse decisions, mitigating insufficient authenticity checks on data from external sources.

addresses: CWE-345

Use of approved PKI certificates provides verifiable data authenticity and origin for communications and artifacts.

addresses: CWE-345

Mandates provision of authenticity and integrity artifacts that enable verification of name/address resolution data.

addresses: CWE-345

Requires explicit verification of data authenticity from authoritative sources, preventing acceptance of unauthenticated resolution responses.

addresses: CWE-345

Control requires verification of data authenticity/integrity (e.g., checksums) after aggregation/packing, directly reducing exploitation of insufficient verification before transmission.

addresses: CWE-345

Time synchronization supports reliable freshness verification when checking data authenticity across systems or components.

addresses: CWE-345

Mandates verification of data authenticity for software, firmware, and information.

addresses: CWE-345

Provenance documentation and monitoring directly enables verification of authenticity for components and data throughout their history.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

RC.RP-05 mostly match
is degraded by

CWE-345 directly impairs RC.RP-05's verification of restored-asset integrity/authenticity, largely defeating the outcome while still leaving other restoration-confirmation steps partially viable.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Security testing can detect missing or weak data authenticity verification.

mitigates

Network controls can enforce authenticated channels, reducing risk of accepting unauthentic data.

mitigates

Secure network services often include authenticity checks for data exchanged over those services.

prevents

Cryptographic mechanisms directly verify data origin and integrity, preventing acceptance of unauthentic data.

prevents

Secure SDLC incorporates authenticity verification requirements throughout development.

prevents

Application security requirements can mandate data authenticity verification mechanisms.

References