SB20261029105 - openEuler 24.03 LTS SP3 update for squid

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261029105

SB20261029105 - openEuler 24.03 LTS SP3 update for squid

Published: October 29, 2026

Security Bulletin ID SB20261029105
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-61642)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

The vulnerability exists due to improper enforcement of behavioral workflow in Squid's HTTP/1.1 Transfer-Encoding handling when processing HTTP/1.1 requests. A remote user can perform HTTP request smuggling to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

An HTTP cache operating before the affected Squid instance is required for cache poisoning.


Remediation

Install update from vendor's website.

References