CVE-2020-14059 Race condition in n/a
A race condition in Squid's SMP cache memory management allows attackers to cause a denial of service via an ABA problem.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14059?
CVE-2020-14059 is a medium-severity vulnerability in Squid-Cache Squid, published on 30 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing objects in an SMP cache because of an Ipc::Mem::PageStack::pop ABA problem during access to the memory page/slot management list.
Weakness: CWE-662
Which versions are affected by CVE-2020-14059?
It affects 1 product.
Linux distribution packages (10)
squid SUSE:Linux Enterprise High Performance Computing 15-ESPOS | All versions | 4.12-5.20.1 |
squid SUSE:Linux Enterprise High Performance Computing 15-LTSS | All versions | 4.12-5.20.1 |
squid SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 4.12-5.20.1 |
squid SUSE:Linux Enterprise Module for Server Applications 15 SP2 | All versions | 4.12-5.20.1 |
squid SUSE:Linux Enterprise Server 12 SP5 | All versions | 4.12-4.12.1 |
squid SUSE:Linux Enterprise Server 15-LTSS | All versions | 4.12-5.20.1 |
squid SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 4.12-4.12.1 |
squid SUSE:Linux Enterprise Server for SAP Applications 15 | All versions | 4.12-5.20.1 |
squid openSUSE:Leap 15.1 | All versions | 4.12-lp151.2.21.1 |
squid openSUSE:Leap 15.2 | All versions | 4.12-lp152.2.3.1 |
Products include Squid-Cache Squid.
How do I fix CVE-2020-14059?
Upgrade to a fixed version.
Is CVE-2020-14059 being exploited?
There is no known exploitation of CVE-2020-14059 in the wild and no public exploit code.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Sources
Also known as SUSE-SU-2020:1769-1, SUSE-SU-2020:1770-1, openSUSE-SU-2020:0910-1, openSUSE-SU-2020:0914-1.