diff --git a/pkgs/servers/squid/default.nix b/pkgs/servers/squid/default.nix
index 8452adcf2221..0afd238721f0 100644
--- a/pkgs/servers/squid/default.nix
+++ b/pkgs/servers/squid/default.nix
@@ -1,15 +1,24 @@
-{ stdenv, fetchurl, perl, openldap, pam, db, cyrus_sasl, libcap
+{ stdenv, fetchurl, fetchpatch, perl, openldap, pam, db, cyrus_sasl, libcap
 , expat, libxml2, openssl, pkgconfig
 }:
 
 stdenv.mkDerivation rec {
-  name = "squid-4.10";
+  pname = "squid";
+  version = "4.10";
 
   src = fetchurl {
-    url = "http://www.squid-cache.org/Versions/v4/${name}.tar.xz";
+    url = "http://www.squid-cache.org/Versions/v4/${pname}-${version}.tar.xz";
     sha256 = "07sz0adv8nkhy797675bpra7lvdkwjq9isw1ddgylhlazl511w4q";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2020-11945.patch";
+      url = "http://www.squid-cache.org/Versions/v4/changesets/squid-4-eeebf0f37a72a2de08348e85ae34b02c34e9a811.patch";
+      sha256 = "1mdi1camvaa6pmpiypw4zmmc4a4mgqgcvdic5wajysgwsqvbz1f3";
+    })
+  ];
+
   nativeBuildInputs = [ pkgconfig ];
   buildInputs = [
     perl openldap db cyrus_sasl expat libxml2 openssl