SB2026103125 - Ubuntu update for squid, squid3
Published: October 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 vulnerabilities.
1) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-61642)
CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.
The vulnerability exists due to improper enforcement of behavioral workflow in Squid's HTTP/1.1 Transfer-Encoding handling when processing HTTP/1.1 requests. A remote user can perform HTTP request smuggling to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.
An HTTP cache operating before the affected Squid instance is required for cache poisoning.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-50012)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service and modify memory.
The vulnerability exists due to heap-based buffer overflow in cache_digest reply handling when processing maliciously crafted replies to cache_digest request messages. A remote privileged user can send a specially crafted reply to cause a denial of service and modify memory.
Only instances compiled with the --enable-cache-digests option are vulnerable, and exploitation requires a trusted peer relationship over TCP.
3) Out-of-bounds read (CVE-ID: CVE-2026-47729)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper validation of syntactic correctness of input in the FTP gateway when accessing a misbehaving FTP server through the gateway feature. A remote user can access a misbehaving FTP server through the gateway feature to disclose sensitive information.
The issue can cause an out-of-bounds read from random unrelated transactions.
4) Use After Free (CVE-ID: CVE-2026-32748)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in ICP request handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to cause a denial of service.
The vulnerability is only exploitable on Squid deployments that have ICP support enabled via a non-zero icp_port configuration.
5) Use After Free (CVE-ID: CVE-2026-33526)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap use-after-free in ICP request handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to cause a denial of service.
The attack is limited to Squid deployments that have ICP support enabled via a non-zero icp_port configuration.
6) Out-of-bounds read (CVE-ID: CVE-2026-33515)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper input validation in ICP message handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to disclose small amounts of memory potentially containing sensitive information.
The attack is limited to Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port).
Remediation
Install update from vendor's website.