CVE-2016-4555

Exploitation likely. EPSS gives it a 18% chance of exploitation in the next 30 days. A vendor fix is available.

CVSS 3.07.5High EPSS percentile97th18% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2016-05-10Updated 2026-05-06Sources: CVE.org, NVD

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check if you (or your IT provider) run Squid version 3.x before 3.5.18 or 4.x before 4.0.10.
If Squid is not installed or already on a newer version, no action is needed.
If affected, upgrade to Squid 3.5.18 or 4.0.10 or later using your package manager or the vendor's official patch.
Restart the Squid service after upgrading and confirm it stays running under normal traffic.
If you can't upgrade immediately, restrict which external servers your Squid proxy is allowed to fetch content from, to reduce exposure.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.

In plain language

Written by AI from the record

If your business runs a Squid proxy server, a malicious or compromised web server it connects to can crash it, but this isn't currently being exploited and fixes have been available for years.

A CWE-20 input validation flaw in Squid's client_side_request.cc allows a remote web server to crash the Squid process via crafted Edge Side Includes (ESI) responses, causing denial of service with no authentication or user interaction needed.

If you're affected

Internet/proxy outage
Service downtime for users behind Squid
Disruption to web filtering or caching

What is it

Squid is software many businesses use as a web proxy — like a gatekeeper that manages and filters internet traffic. This bug lets a bad actor send a specially crafted response that makes the gatekeeper collapse, temporarily shutting off internet access for everyone relying on it, like a security guard fainting and locking the door behind them.

Who is affected

This matters to you if you run a Squid proxy server (often used for web caching, content filtering, or internet access control) on version 3.x before 3.5.18 or 4.x before 4.0.10. It's a risk if your Squid instance fetches or relays content from external or untrusted web servers, since the crash is triggered by the server's response, not by an attacker needing a login.

How urgent is it

There's no confirmed sign that attackers are actively exploiting this flaw today, and it isn't on any known actively-exploited list, but it is reachable over the network without any login and could knock out your proxy service. Treat it as a real but moderate risk — schedule the upgrade in your normal patch cycle rather than treating it as an emergency.

What to do — in detail

Confirm exposure by checking installed Squid version (squid -v) and verifying ESI support is compiled in and your proxy fetches content from external/untrusted origin servers. Fixed versions: 3.5.18 for the 3.x branch, 4.0.10 for the 4.x branch (patches also exist for 3.4.x per Squid Advisory SQUID-2016_9). Apply the official patch from squid-cache.org (SQUID-2016_9.patch) or upgrade via your distribution's package manager (Ubuntu/Debian users should pull the backported fix). No significant breaking changes are expected from this specific patch. If immediate patching isn't possible, consider disabling ESI processing if not required, or restrict Squid's upstream server allowlist to trusted origins only. Not listed in CISA KEV, so there is no mandated remediation deadline. Monitor Squid process stability/crash logs after exposure to untrusted upstream servers, and track Squid security advisories for any escalation in exploitation activity.

Technical context

CVSS 7.5 (High), AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H — network-exploitable, low complexity, no privileges or interaction required, availability impact only (crash/DoS), confidentiality and integrity unaffected. Weakness: CWE-20 (Improper Input Validation) in ESI response parsing within client_side_request.cc. EPSS predicted exploitation likelihood is in the 97th percentile but trending downward; no public exploit code is known to exist and the CVE is not in CISA's Known Exploited Vulnerabilities catalog, so exploit maturity is assessed as low/theoretical despite the high percentile ranking. Press attention is rising but this reflects general interest, not confirmed active exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS97th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

18% chance of exploitation activity in the next 30 days, which ranks it in the 97th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 3802 days, from the signal feeds we watch.

2026-10-07EPSS band changehigh → moderateepss band change
2026-06-25OpenVAS check added
2026-05-06Patch availablerecord updated
2016-05-10Publishedweakness classified, att&ck mapped

Affected products

squid-cacheoss-projectaka squid, squid cache
- squidNetwork DeviceOn-premNetworking Infrastructure / load-balancer-proxy
canonicalcommercial · GBaka canonical ltd.
- ubuntu linuxOSOn-premOperating Systems / linux-distro
oraclecommercial · USaka oracle corp.
- linuxOn-premDatabases / cache-message-queue

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality NoneNo confidentiality impact
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable