CVE-2014-0128 in Squid
Summary
by MITRE
Squid 3.1 before 3.3.12 and 3.4 before 3.4.4, when SSL-Bump is enabled, allows remote attackers to cause a denial of service (assertion failure) via a crafted range request, related to state management.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/10/2026
The vulnerability identified as CVE-2014-0128 represents a critical denial of service flaw affecting Squid proxy servers with SSL-Bump functionality enabled. This issue impacts versions 3.1.x prior to 3.3.12 and 3.4.x prior to 3.4.4, where the proxy's state management mechanism fails to properly handle crafted range requests during SSL interception. The flaw specifically manifests when Squid processes HTTP range requests that contain malformed or unexpected parameters while operating in SSL-Bump mode, which is commonly used for transparent SSL proxying and content inspection. The vulnerability stems from insufficient validation of range request parameters within the proxy's state tracking system, leading to assertion failures that cause the proxy process to terminate unexpectedly.
The technical exploitation of this vulnerability occurs through carefully crafted HTTP range requests that trigger malformed state transitions within Squid's SSL-Bump implementation. When SSL-Bump is enabled, Squid intercepts and inspects SSL traffic by establishing separate connections to both client and server, requiring complex state management to maintain session integrity. The assertion failure occurs during the processing of range requests where the proxy's internal state validation logic encounters unexpected parameter combinations that were not properly accounted for in the state management code. This condition is particularly dangerous because it can be triggered remotely without authentication, making it an attractive target for denial of service attacks against proxy infrastructure. The flaw demonstrates poor input validation practices and inadequate error handling within the proxy's SSL interception subsystem, creating a pathway for attackers to destabilize the entire proxy service.
The operational impact of CVE-2014-0128 extends beyond simple service disruption, potentially affecting organizations that rely on Squid as a critical infrastructure component for web filtering, caching, or security inspection. When exploited, the vulnerability can cause cascading failures in proxy services, particularly in environments where SSL-Bump is actively used for content inspection or security monitoring. Network administrators may experience unexpected proxy crashes, leading to service interruptions for users who depend on the proxy for internet access. The vulnerability also affects organizations using Squid in enterprise environments where proxy servers handle significant volumes of SSL traffic, as the denial of service can be sustained through repeated attacks. This issue particularly impacts web filtering solutions that utilize SSL-Bump for inspecting encrypted traffic, potentially compromising network security monitoring capabilities while simultaneously disrupting legitimate network operations.
Organizations should prioritize immediate patching of affected Squid installations to address this vulnerability, as no effective workarounds exist for the underlying state management flaw. The recommended mitigation strategy involves upgrading to Squid versions 3.3.12 or 3.4.4, which contain fixes for the assertion failure in range request handling. System administrators should also consider implementing additional monitoring and intrusion detection measures to identify potential exploitation attempts, particularly in environments where SSL-Bump is enabled. The vulnerability aligns with CWE-119, which addresses improper restriction of operations within a limited scope, and represents a classic example of inadequate input validation leading to system instability. From an ATT&CK framework perspective, this vulnerability maps to the T1499.004 technique related to network disruption through service exhaustion, though the specific mechanism involves assertion failures rather than resource exhaustion. Organizations should also review their proxy configurations to ensure that SSL-Bump is only enabled when necessary, as this reduces the attack surface for exploitation while maintaining essential security functions.