---
title: "CVE-2021-28652\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2021-28652?format=md
keywords: index, follow
---

# CVE-2021-28652

Publication date 27 May 2021

Last updated 25 August 2025

---

Ubuntu priority

**Low**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**4.9 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2021-28652?format=md#impact-score)

Toggle side navigation

## Description

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to
incorrect parser validation, it allows a Denial of Service attack against
the Cache Manager API. This allows a trusted client to trigger memory leaks
that. over time, lead to a Denial of Service via an unspecified short query
string. This attack is limited to clients with Cache Manager API access
privilege.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2021-28652?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| squid | 22.04 LTS jammy | Fixed 4.13-10ubuntu1 |
| 21.10 impish | Fixed 4.13-10ubuntu1 |
| 21.04 hirsute | Fixed 4.13-1ubuntu4.1 |
| 20.10 groovy | Fixed 4.13-1ubuntu2.2 |
| 20.04 LTS focal | Fixed 4.10-1ubuntu1.4 |
| 18.04 LTS bionic | Not in release |
| 16.04 LTS xenial | Not in release |
| 14.04 LTS trusty | Not in release |
| squid3 | 22.04 LTS jammy | Not in release |
| 21.10 impish | Not in release |
| 21.04 hirsute | Not in release |
| 20.10 groovy | Not in release |
| 20.04 LTS focal | Not in release |
| 18.04 LTS bionic | Fixed 3.5.27-1ubuntu1.11 |
| 16.04 LTS xenial | Ignored |
| 14.04 LTS trusty | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)
* [Patch details](https://ubuntu.com/security/CVE-2021-28652?format=md#patch-details)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

this issue only affects the Cache Manager, which is usually
restricted to trusted clients only.
The patch is intrusive to backport to 3.x versions, so we will
not be fixing this issue in older releases. We recommend setting
appropriate access control to limit connections from trusted
clients.

### Patch details

For informational purposes only. We recommend not to cherry-pick updates. [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)

| Package | Patch details |
| --- | --- |
| squid | * Upstream:   <http://www.squid-cache.org/Versions/v4/changesets/squid-4-0003e3518dc95e4b5ab46b5140af79b22253048e.patch> * Upstream:   [0003e35](https://github.com/squid-cache/squid/commit/0003e3518dc95e4b5ab46b5140af79b22253048e) |

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

4.9 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | High |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 4.9 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28652)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-28652)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2021-28652)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2021-28652)

### Related Ubuntu Security Notices (USN)

+ [USN-4981-1](https://usn.ubuntu.com/USN-4981-1)
+ Squid vulnerabilities
+ 3 June 2021

### Other references

* <https://github.com/squid-cache/squid/security/advisories/GHSA-m47m-9hvw-7447>
* <https://www.cve.org/CVERecord?id=CVE-2021-28652>