CVE-2010-3072 Null dereference in n/a
Remote attackers can crash the Squid proxy server via a crafted request due to a NULL pointer dereference in string comparison functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2010-3072?
CVE-2010-3072 is a medium-severity vulnerability in Squid-Cache Squid, published on 20 Sep 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Which versions are affected by CVE-2010-3072?
It affects 1 product.
Linux distribution packages (4)
squid Red Hat:enterprise_linux:6::server | All versions | 7:3.1.10-1.el6 |
squid-debuginfo Red Hat:enterprise_linux:6::server | All versions | 7:3.1.10-1.el6 |
squid Red Hat:enterprise_linux:6::workstation | All versions | 7:3.1.10-1.el6 |
squid-debuginfo Red Hat:enterprise_linux:6::workstation | All versions | 7:3.1.10-1.el6 |
Products include Squid-Cache Squid.
How do I fix CVE-2010-3072?
Upgrade to a fixed version.
Is CVE-2010-3072 being exploited?
There is no known exploitation of CVE-2010-3072 in the wild and no public exploit code.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Sources
Also known as DSA-2111-1, GHSA-744h-wcjj-gwrf, RHSA-2011:0545.