REDHAT-BUG-2548703: High severity Squid Squid vulnerability

Q: Who is exposed to this issue?

Deployments running Squid versions 3.3.0.1 through 7.5 are affected. Exploitation requires a trusted client capable of sending crafted HTTP/1.1 requests through Squid.

Q: Are default deployments affected?

The provided information does not identify any configuration prerequisite beyond using an affected Squid version. The issue is specifically triggered during processing of HTTP/1.1 Transfer-Encoding headers.

Q: When does this become a cache-poisoning risk?

Cache poisoning is possible when an HTTP cache operates before the affected Squid instance. In that topology, an attacker may store malicious content at arbitrary URLs for later delivery to other clients.

Q: What version contains the fix?

The fix is available in Squid version 7.6.

Published Oct 9, 2026

Updated

A request smuggling vulnerability was found in Squid. Due to improper enforcement of behavioral workflow when processing HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack. This can bypass security mechanisms between the attacker and Squid. When an HTTP cache operates prior to the affected Squid instance, this also allows cache poisoning, enabling the attacker to store arbitrary malicious content at any URL for delivery to other clients.

Squid versions 3.3.0.1 through 7.5 are affected. The fix is available in version 7.6.

Affected Software

1 affected component

Squid Squid>=3.3.0.1<=7.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Squid to a version that resolves this vulnerability.
Fixed in 7.6

Event History

Oct 9, 2026

Data Sourced

via Red Hat·03:53 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Deployments running Squid versions 3.3.0.1 through 7.5 are affected. Exploitation requires a trusted client capable of sending crafted HTTP/1.1 requests through Squid.

Are default deployments affected?

The provided information does not identify any configuration prerequisite beyond using an affected Squid version. The issue is specifically triggered during processing of HTTP/1.1 Transfer-Encoding headers.

When does this become a cache-poisoning risk?

Cache poisoning is possible when an HTTP cache operates before the affected Squid instance. In that topology, an attacker may store malicious content at arbitrary URLs for later delivery to other clients.

What version contains the fix?

The fix is available in Squid version 7.6.

REDHAT-BUG-2548703: High severity Squid Squid vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

Are default deployments affected?

When does this become a cache-poisoning risk?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

Are default deployments affected?

When does this become a cache-poisoning risk?

What version contains the fix?