CVE-2021-31808: 
Squid vulnerability analysis and mitigation

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to an input-validation bug, it is vulnerable to a Denial of Service attack (against all clients using the proxy). A client sends an HTTP Range request to trigger this vulnerability (NVD, GitHub Advisory).

The vulnerability is caused by an integer overflow bug in the HTTP Range header processing. The issue has a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is triggered by a header that can be expected to exist in HTTP traffic without any malicious intent (NVD, NetApp Advisory).

Successful exploitation of this vulnerability leads to a Denial of Service (DoS) condition affecting all clients using the proxy. The attack impacts the availability of the service while having no effect on confidentiality or integrity of the data (NetApp Advisory).

The vulnerability is fixed in Squid versions 4.15 and 5.0.6. Users are recommended to upgrade to these or later versions. No workarounds are known for this vulnerability (GitHub Advisory, Debian Advisory).

Multiple Linux distributions and software vendors have released security advisories and patches for this vulnerability, including Debian, Fedora, and NetApp. The vulnerability was part of a larger security audit of Squid that discovered 55 vulnerabilities in total, as reported by security researcher Joshua Rogers (OSS Security).