The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a “,” character in an Accept-Language header.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 9 | all | squid3 | < 3.5.23-5+deb9u1 | squid3_3.5.23-5+deb9u1_all.deb |