Request Smuggling Vulnerability in Squid Caching Proxy
CVE-2026-61642

7.7HIGH

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
13 October 2026

What is CVE-2026-61642?

The Squid caching proxy is vulnerable to a Request Smuggling attack due to improper handling of HTTP/1.1 Transfer-Encoding. This vulnerability allows a trusted client to bypass security measures and perform malicious actions by manipulating HTTP headers. Attackers can exploit this flaw to poison web caches, delivering harmful content to users through compromised URLs. This issue is fixed in version 7.6 of the Squid software.

Affected Version(s)

squid >= 3.3.0.1, < 7.6

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_CONFIRM
https://github.com/squid-cache/squid/pull/2427
x_refsource_MISC
https://github.com/squid-cache/squid/pull/2431
x_refsource_MISC

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.