RHSA-2026:99124: Important: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.Security Fix(es): squid: squid: Request Smuggling in HTTP Transfer-Encoding (CVE-2026-61642) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1 - Upgrade
Upgrade
redhat/squid-debuginfoto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1 - Upgrade
Upgrade
redhat/squid-debugsourceto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1 - Upgrade
Upgrade
redhat/squidto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1.aa - Upgrade
Upgrade
redhat/squid-debuginfoto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1.aa - Upgrade
Upgrade
redhat/squid-debugsourceto a version that resolves this vulnerability.Fixed in 5.5-26.el9_8.1.aa
Event History
Frequently Asked Questions
Which installed packages should be reviewed when applying this update?
Review installations of the Red Hat squid package. The advisory also lists squid-debuginfo and squid-debugsource as affected software.
What type of traffic is relevant to this issue?
The issue is described as HTTP request smuggling involving HTTP Transfer-Encoding. Systems using Squid as a proxy or caching server for HTTP traffic are therefore relevant to triage.
How urgent is remediation according to the vendor classification?
Red Hat classifies this as an Important security update. The advisory was published and modified on 2026-11-11.