Inconsistent interpretation of HTTP requests in Squid - CVE-2026-61642

Vulnerability identifier: #VU149503

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-61642

CWE-ID: CWE-444

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

The vulnerability exists due to improper enforcement of behavioral workflow in Squid's HTTP/1.1 Transfer-Encoding handling when processing HTTP/1.1 requests. A remote user can perform HTTP request smuggling to bypass security mechanisms and poison an HTTP cache with arbitrary malicious content.

An HTTP cache operating before the affected Squid instance is required for cache poisoning.

Squid
Ubuntu
openEuler
squid (Ubuntu package)
squid-openssl (Ubuntu package)
squid-debugsource
squid-debuginfo
squid

Install security update from vendor's website.

Squid - update to 7.6
squid (Ubuntu package) - addressed in versions 3.5.12-1ubuntu7.16+esm7, 3.5.27-1ubuntu1.14+esm6, 4.10-1ubuntu1.13+esm3, 5.9-0ubuntu0.22.04.8, 6.14-0ubuntu0.24.04.5
squid-openssl (Ubuntu package) - addressed in versions 5.9-0ubuntu0.22.04.8, 6.14-0ubuntu0.24.04.5
squid-debugsource - addressed in versions 4.9-33, 6.6-10
squid-debuginfo - addressed in versions 4.9-33, 6.6-10
squid - addressed in versions 4.9-33, 6.6-10

• https://github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6
• https://github.com/squid-cache/squid/commit/d06f48de8b8cc9a378cb91ecfe8e89b6e81696d2.patch

• Multiple vulnerabilities in Squid
• openEuler 24.03 LTS SP3 update for squid
• openEuler 24.03 LTS SP1 update for squid
• openEuler 22.03 LTS SP4 update for squid
• openEuler 24.03 LTS SP4 update for squid
• Ubuntu update for squid, squid3