If you only look at the esoteric issues, then yes, it would seem that they're unlikely to be leveraged. However, from the top 5: Chunked Encoding Stack Over

If you only look at the esoteric issues, then yes, it would seem that they're unlikely to be leveraged. However, from the top 5: Chunked Encoding Stack Overflow X-Forwarded-For Stack Overflow Cache Poisoning by Large Stored Response Headers (With Bonus XSS) all pertain to issues affecting practically every single Squid instance. Except perhaps FTP but I believe squid must be configured to allow FTP proxying anyway This is specifically mentioned, for example https://megamansec.github.io/Squid-Security-Audit/ftp-assert.html https://megamansec.github.io/Squid-Security-Audit/ftp-assert...: A reproducer is given base64-encoded. (Note: This does NOT require Squid to even be enabled to proxy FTP links, and even with the configuration acl ftp proto FTP http_access deny ftp this crash will occur).