CVE-2026-61642: Squid Request Smuggling in HTTP Transfer-Encoding
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Squidto a version that resolves this vulnerability.Fixed in 7.6
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Squid versions from 3.3.0.1 through versions before 7.6 are affected when HTTP/1.1 is used. Exploitation is especially consequential when a cache operates in front of the affected Squid, because that cache may be poisoned.
What access does an attacker need?
The attacker must be a trusted client able to send HTTP/1.1 requests to the affected Squid. No user interaction is required, and the issue can bypass security mechanisms located between the attacker and Squid.
What is the impact when an upstream cache is present?
An attacker can poison the cache before Squid and store arbitrary malicious content at any URL. That content may then be served to other clients making future requests to those URLs.
What version resolves the issue?
The issue is fixed in Squid 7.6. Affected deployments should upgrade to version 7.6 or later.