Ubuntu Squid flaws allow request smuggling and cache crashes
CVE-2026-61642 can smuggle requests or poison caches; a separate digest bug crashes older Ubuntu releases.
44
CVE-2026-61642
HTTP request smuggling in Squid via Transfer-Encoding
- CVSS 3.1
- 7.7 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Squid versions from 3.3.0.1 up to but not including 7.6 mishandle HTTP/1.1 by accepting a bare Transfer-Encoding: identity header, which the HTTP specification forbids because a transfer coding must be used with chunked encoding. A trusted client that can send requests through the proxy can use this parsing bug to smuggle an HTTP request and bypass security controls placed between the attacker and Squid. If another HTTP cache sits in front of the affected Squid, the smuggled request can also poison that cache so later clients receive attacker-controlled content for arbitrary URLs. The issue is fixed in Squid 7.6. It is not listed in CISA KEV, and no public proof-of-concept exploit is known.
What to do: Upgrade Squid to 7.6 or later. Until then, restrict which clients may send requests through the proxy and review any HTTP cache in front of Squid for poisoned entries. Prefer HTTP/2 or tightly controlled HTTP/1.1 front ends where request parsing is consistent end to end.
| Product | Affected |
|---|---|
| Squid | 3.3.0.1 through versions before 7.6 |
Estimated exposure
largetens of thousands of internet-exposed instances, plus a larger internal install base (order of 100,000+ deployments) — Squid is a widely deployed open-source caching proxy in enterprises, ISPs, and some public services; public internet scans have historically shown on the order of tens of thousands of exposed Squid instances, with a much larger internal…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Weakness
- CWE-444
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N