Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.