Skip to content
OpenAdvisories
High ALSA-2026:96078 1 CVE

Important: squid:4 security update

Published Nov 9, 2026 · Updated Nov 9, 2026

Ecosystem: AlmaLinux

Summary

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid: squid: Request Smuggling in HTTP Transfer-Encoding (CVE-2026-61642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 5

ReleasePackageFixed in
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+2741+01592ae8
AlmaLinux · 8 libecap-devel 1.0.1-2.module_el8.6.0+3048+383bc947
AlmaLinux · 8 squid 7:4.15-10.module_el8.10.0+4354+d3ed158a.13

Vulnerabilities 1

  • High 7.7
    CVE-2026-61642

    Squid Request Smuggling in HTTP Transfer-Encoding

    Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accept…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • report
    https://access.redhat.com/security/cve/CVE-2026-61642
  • report
    https://bugzilla.redhat.com/2548703
  • advisory
    https://errata.almalinux.org/8/ALSA-2026-96078.html