SB2026062453 - Multiple vulnerabilities in Squid

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026062453

SB2026062453 - Multiple vulnerabilities in Squid

Published: June 24, 2026 Updated: September 14, 2026

Security Bulletin ID SB2026062453
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Out-of-bounds read (CVE-ID: CVE-2026-47729)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper validation of syntactic correctness of input in the FTP gateway when accessing a misbehaving FTP server through the gateway feature. A remote user can access a misbehaving FTP server through the gateway feature to disclose sensitive information.

The issue can cause an out-of-bounds read from random unrelated transactions.


2) Heap-based buffer overflow (CVE-ID: CVE-2026-50012)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service and modify memory.

The vulnerability exists due to heap-based buffer overflow in cache_digest reply handling when processing maliciously crafted replies to cache_digest request messages. A remote privileged user can send a specially crafted reply to cause a denial of service and modify memory.

Only instances compiled with the --enable-cache-digests option are vulnerable, and exploitation requires a trusted peer relationship over TCP.


3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-61642)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

The vulnerability exists due to improper enforcement of behavioral workflow in Squid's HTTP/1.1 Transfer-Encoding handling when processing HTTP/1.1 requests. A remote user can perform HTTP request smuggling to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

An HTTP cache operating before the affected Squid instance is required for cache poisoning.


Remediation

Install update from vendor's website.

References