RLSA-2026:98643: Important: squid security update
Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.
Security Fix(es):
squid: squid: Request Smuggling in HTTP Transfer-Encoding (CVE-2026-61642)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rocky-linux/squid-debugsourceto a version that resolves this vulnerability.Fixed in 7:6.10-15.el10_3.1 - Upgrade
Upgrade
rocky-linux/squidto a version that resolves this vulnerability.Fixed in 7:6.10-15.el10_3.1 - Upgrade
Upgrade
rocky-linux/squid-debuginfoto a version that resolves this vulnerability.Fixed in 7:6.10-15.el10_3.1
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity. An attacker also needs low-level privileges, and no user interaction is required.
What is the likely security impact?
The listed CVSS vector rates integrity impact as high and confidentiality and availability impact as none. Its scope is changed, meaning the impact may extend beyond the initially affected security authority.
Which Rocky Linux packages are covered by this update?
The advisory lists squid, squid-debugsource, and squid-debuginfo. The security issue is identified as CVE-2026-61642.