Skip to content
OpenAdvisories
High USN-8998-1 1 CVE

squid vulnerability

Published Nov 4, 2026 · Updated Nov 5, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Squid incorrectly handled certain HTTP Transfer-
Encoding headers. An attacker could possibly use this issue to perform
HTTP request smuggling attacks, bypass security mechanisms, or poison
web caches.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 26.04 LTS 26.04:LTS squid 7.7-0ubuntu0.26.04.2

Vulnerabilities 1

  • High 7.7
    CVE-2026-61642

    Squid Request Smuggling in HTTP Transfer-Encoding

    Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accept…

    squid-cache squid squid squid3 Debian Ubuntu Azure Linux

References

  • report
    https://ubuntu.com/security/CVE-2026-61642