Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-61642: Squid proxy can be tricked into request smuggling

CVE-2026-61642 · published 22 days ago

Summary

Versions of Squid from 3.3.0.1 up to before 7.6 may let a trusted client send specially crafted requests that slip past security controls and hide malicious content in the web cache. This can cause unwanted data to be served to other users. Upgrade Squid to version 7.6 or later to stop the problem.

What to do

Update debian squid to version 7.6-1.
Update canonical squid3 to version 3.5.12-1ubuntu7.16+esm7.
Update canonical squid3 to version 3.5.27-1ubuntu1.14+esm6.
Update canonical squid to version 4.10-1ubuntu1.13+esm3.
Update canonical squid to version 5.9-0ubuntu0.22.04.8.
Update canonical squid to version 6.14-0ubuntu0.24.04.5.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	squid	All versions
Debian:13	debian	squid	All versions
Debian:14	debian	squid	< 7.6-1 Fix: upgrade to 7.6-1
Ubuntu:Pro:16.04:LTS	canonical	squid3	< 3.5.12-1ubuntu7.16+esm7 Fix: upgrade to 3.5.12-1ubuntu7.16+esm7
Ubuntu:Pro:20.04:LTS	canonical	squid	< 4.10-1ubuntu1.13+esm3 Fix: upgrade to 4.10-1ubuntu1.13+esm3
–	squid-cache	squid	>= 3.3.0.1, < 7.6
Ubuntu:Pro:18.04:LTS	canonical	squid3	< 3.5.27-1ubuntu1.14+esm6 Fix: upgrade to 3.5.27-1ubuntu1.14+esm6
Ubuntu:22.04:LTS	canonical	squid	< 5.9-0ubuntu0.22.04.8 Fix: upgrade to 5.9-0ubuntu0.22.04.8
Ubuntu:24.04:LTS	canonical	squid	< 6.14-0ubuntu0.24.04.5 Fix: upgrade to 6.14-0ubuntu0.24.04.5

Original advisory text

Squid Request Smuggling in HTTP Transfer-Encoding

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

References

https://github.com/squid-cache/squid/commit/d06f48de8b8cc9a378cb91ecfe8e89b6e816... Patch
https://github.com/squid-cache/squid/commit/d808a7c825a70275113790471135c9c4d547... Patch
https://github.com/squid-cache/squid/pull/2427 Patch
https://github.com/squid-cache/squid/pull/2431 Patch
https://security-tracker.debian.org/tracker/CVE-2026-61642 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61642... Vendor Advisory
https://github.com/squid-cache/squid/releases/tag/SQUID_7_6 URL
https://nvd.nist.gov/vuln/detail/CVE-2026-61642 Vendor Advisory
https://ubuntu.com/security/CVE-2026-61642 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-61642 Third Party Advisory
https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6 Third Party Advisory
https://ubuntu.com/security/notices/USN-8941-1 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.7 High

Exploitation

2% chance of attack within 30 days

Type

CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Timeline

Published13 Oct 2026

Updated4 Nov 2026

First seen17 Sep 2026

Sources

DEBIAN-CVE-2026-61642 · OSV

UBUNTU-CVE-2026-61642 · OSV

CVE-2026-61642 · NVD

CVE-2026-61642 · MITRE

CVE-2026-61642 · OSV

GHSA-537g-4gfh-w7m6 · GHSA

Track software like this

Free during beta