Ubuntu Squid flaws allow request smuggling and cache crashes
Original title: USN-8941-1: Squid vulnerabilities
CVE-2026-61642 can smuggle requests or poison caches; a separate digest bug crashes older Ubuntu releases.
Ubuntu security notice USN-8941-1 says Squid mishandled certain HTTP Transfer-Encoding headers, letting an attacker attempt request smuggling, bypass security controls, or poison web caches (CVE-2026-61642). A separate flaw in cache digest replies can overflow a buffer and crash Squid, and it only affects Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS (CVE-2026-50012). The notice also begins describing a flaw in parsing certain FTP directory listings, but that detail is cut off.
Unconfirmed: Fixed package versions and the full FTP-listing flaw are not in the provided snippet.
- CVE-2026-50012 is limited to Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS.
- The FTP listing issue is mentioned but not fully described in the available text.
- No exploitation status is stated.
Impact: HTTP request smuggling, cache poisoning, or denial of service
| Product | Affected |
|---|---|
| Squid | Ubuntu 16.04 LTS, 18.04 LTS and 20.04 LTS for CVE-2026-50012; others not stated |
- 1.Apply the Ubuntu security updates for Squid from USN-8941-1.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-50012 | Squid: Due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is… | 5.5 | 1% | ||
| CVE-2026-61642 | HTTP request smuggling in Squid via Transfer-Encoding | 7.7 | — |
From the original article
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642) It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.