CVE-2026-61642
HighCVSS 7.7Summary
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to improper enforcement of behavioral workflow, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding, accepting the prohibited 'Transfer-Encoding: identity' form.
Risk Assessment
The risk includes the possibility of Request Smuggling attacks, bypassing security mechanisms, and HTTP cache poisoning, potentially delivering malicious content to other clients.
Recommendation
Upgrade Squid to version 7.6 or later, which fixes this issue.
Other vulnerabilities in Squid
See all- CVE-2016-4556High
A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
- CVE-2016-4554High
The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.
- CVE-2016-4553High
The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.
- CVE-2016-4054High
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-4052High
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-3948High
Squid versions 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, allowing remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.
- CVE-2016-2571High
In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
- CVE-2016-2569High
Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
- CVE-2026-33526High
Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.
- CVE-2026-32748High
Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).
Original NVD description (English source)
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS