russell@unturf.com
652608142a
All projects with patches now have outreach docs. 276 new docs covering CWE-407, CWE-312, CWE-362 across C, C++, Java, Python, Go, Rust, C#, PHP, Ruby, JavaScript, Dart, Erlang, R, and more. Outreach gap: 276 -> 0.
1.7 KiB
Squid — CWE-407 Disclosure Brief (squid-0002)
2026-04-13 · Patch available — awaiting upstream merge
Finding
An O(H×C) linear scan in HttpHeader::removeConnectionHeaderEntries() at src/HttpHeader.cc:1859. For each header entry H, strListIsMember() scans the Connection header token list C to check if the entry should be removed. With H headers and C connection tokens, total cost reaches O(H×C) per response hop.
The Defect
squid-0002 (PATCHED — MEDIUM): src/HttpHeader.cc:1859
while ((e = getEntry(&pos))) {
if (strListIsMember(&strConnection, e->name, ',')) // O(C) per header
delAt(pos, headers_deleted);
}
Complexity Proof
At H=50 headers, C=10 Connection tokens:
- Defective: 50 × 10 = 500 string comparisons per response
- Fixed: 10 set inserts + 50 × O(1) = 60 operations
- 8× op reduction per response
Impact
Squid processes HTTP responses at scale. Connection header cleanup fires on every proxied response per RFC 7230. High-traffic proxies handling millions of responses per second accumulate this cost. Responses with many headers and multiple Connection tokens trigger the worst case.
The Fix
Parse Connection header tokens into an std::unordered_set<SBuf> once, then use O(1) count() lookups per header entry.
Patch
Fix available: defects/squid-0002/patch/squid-0002.patch
8× op reduction at H=50, C=10.
What We Ask
- Confirm receipt and assign a Bugzilla reference (bugs.squid-cache.org).
- Assess severity — fires on every proxied HTTP response.
- Coordinate a disclosure date — targeting 90 days from first contact.
- We will credit the Squid team in the public disclosure.
Contact: see cover email. This brief is confidential until coordinated disclosure.