CVE-2020-15049: An issue was discovered in http/ContentLengthInterpreter.cc in Squid before 4.12 and 5.x before 5.0.3.

Security readout for executives and security teams

CVE-2020-15049 affects Squid HTTP cache/proxy. A malformed Content-Length value can let an authenticated network client cause request smuggling and cache poisoning. Business risk is high where Squid fronts web traffic or shared cache paths, because poisoned responses can affect other users and undermine trust in cached content. Exposure is most likely in environments running Squid as an HTTP cache or proxy before 4.12, or Squid 5.x before 5.0.3. Linux distribution packages may include backported fixes, so vulnerability managers should verify package advisory status, not only upstream version strings. Prioritize remediation for internet-facing, shared, or reverse-proxy Squid deployments. The critical score and cache-poisoning impact justify near-term patching, even without confirmed active exploitation in the provided sources. Mitigation focus: Upgrade Squid to 4.12 or later, or 5.0.3 or later, following vendor guidance.; Apply relevant Debian, Ubuntu, Fedora, openSUSE, or appliance vendor security updates.; Review Squid upstream advisories and patches for the exact maintained branch in use..

Prepared

May 22, 2026, 06:10 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.