Multiple security vulnerabilities have been identified in Squid, a web proxy cache server, affecting 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, and 16.04 LTS. The flaws involve HTTP header handling, cache digest processing, FTP directory listing parsing, and ICP traffic handling. They can allow request smuggling, cache poisoning, denial of service, or sensitive information disclosure. Overall risk is elevated for deployments that expose Squid to untrusted network traffic.
CVE-2026-61642: Improper handling of HTTP Transfer-Encoding headers could allow an attacker to perform HTTP request smuggling, bypass security mechanisms, or poison web caches.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in Squid, a web proxy cache server, affecting 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, and 16.04 LTS. The flaws involve HTTP header handling, cache digest processing, FTP directory listing parsing, and ICP traffic handling. They can allow request smuggling, cache poisoning, denial of service, or sensitive information disclosure. Overall risk is elevated for deployments that expose Squid to untrusted network traffic.
CVE-2026-61642: Improper handling of HTTP Transfer-Encoding headers could allow an attacker to perform HTTP request smuggling, bypass security mechanisms, or poison web caches.[emaillocker id="1283"]
CVE-2026-50012: Improper handling of cache digest replies could cause a buffer overflow, allowing a remote attacker to crash Squid and trigger a denial-of-service condition.
CVE-2026-47729: Improper parsing of FTP directory listings could allow a remote attacker to obtain sensitive information.
CVE-2026-32748: Improper handling of certain ICP traffic could allow a remote attacker to crash Squid, resulting in a denial-of-service condition.
CVE-2026-33526: Improper handling of certain ICP traffic could allow a remote attacker to crash Squid, resulting in a denial-of-service condition.
CVE-2026-33515: Improper handling of certain ICP requests could allow a remote attacker to obtain sensitive information.
These vulnerabilities collectively present a significant risk to Squid deployments that process untrusted HTTP, FTP, or ICP traffic, especially proxy servers reachable from external networks. Organizations should prioritize exposure assessment and risk management for affected systems.
The following reports contain further technical details:
[/emaillocker]