# HTTP Smuggling multiple issues in Squid 3.x & squid 4.x

Squid accepted whitespace between header name and colon, letting a crafted Transfer-Encoding header split requests and desync front-end proxies for cache poisoning and filter bypass.

- Payout: hidden
- Severity: critical
- Program: Internet Bug Bounty
- Found by: regilero
- Disclosed: 2021-08-26
- CVE: CVE-2019-18678, CVE-2020-15811, CVE-2020-8449
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/758445
- Library page: https://bugbountylibrary.com/r/h1%3A758445
- Tags: area:cloud domain:infra impact:dos impact:integrity kind:bounty platform:hackerone sev:critical technique:fuzzing technique:parser-differential vuln:cache-poisoning vuln:request-smuggling

**Target:** Squid HTTP proxy message parser
**Root cause:** Squid tolerated whitespace/pseudo-whitespace characters between header field-name and colon, contrary to RFC 7230, so it parsed Transfer-Encoding differently than front-end actors.
**Steps:**
1. Send a request with `Transfer-Encoding\x0b: chunked` (or space/tab/\f/\r variants) before the colon.
2. Include a Content-Length and a chunked body containing a smuggled `GET /foo.html?t=42` request.
3. Observe Squid emit three responses for what should be two requests, confirming desync.
**How found:** Researcher audited Squid's HTTP message parsing against RFC 7230's explicit prohibition on whitespace before the colon, then tested pseudo-whitespace variants to find parser disagreement with front-end actors.
**Exploitation:** Attacker sends a request whose malformed Transfer-Encoding header is ignored by the front-end proxy but honored by Squid (or vice versa), causing the smuggled request to be prepended to the next user's response stream, poisoning caches and bypassing front-end security filters.
**Escalation:** Chaining with a front-end SSL terminator/cache amplifies impact to cache poisoning, stored XSS, and DoS across all downstream users.
**Insight:** When auditing proxies, enumerate every whitespace/pseudo-whitespace byte (space, tab, \f, \r, \x0b) before the colon in Transfer-Encoding and Content-Length; RFC 7230 forbids them precisely because parser disagreement yields desync.