CVE-2011-3205 Memory corruption in n/a
Remote Gopher servers can trigger a buffer overflow in Squid, causing denial of service or potential code execution via malicious responses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-3205?
CVE-2011-3205 is a medium-severity memory corruption vulnerability in Squid-Cache Squid, published on 6 Sep 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
Which versions are affected by CVE-2011-3205?
It affects 1 product.
Linux distribution packages (2)
squid Red Hat:enterprise_linux:6::server | All versions | 7:3.1.10-1.el6_1.1 |
squid-debuginfo Red Hat:enterprise_linux:6::server | All versions | 7:3.1.10-1.el6_1.1 |
Products include Squid-Cache Squid.
How do I fix CVE-2011-3205?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2011-3205 being exploited?
There is no known exploitation of CVE-2011-3205 in the wild and no public exploit code.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Sources
Also known as DSA-2304-1, GHSA-xv7f-73w8-27qj, RHSA-2011:1293.