USN-8941-1: Squid vulnerabilities
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642) It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012) It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729) It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526) It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/squidto a version that resolves this vulnerability.Fixed in 6.14-0ubuntu0.24.04.5 - Upgrade
Upgrade
ubuntu/squid-opensslto a version that resolves this vulnerability.Fixed in 6.14-0ubuntu0.24.04.5 - Upgrade
Upgrade
ubuntu/squidto a version that resolves this vulnerability.Fixed in 5.9-0ubuntu0.22.04.8 - Upgrade
Upgrade
ubuntu/squid-opensslto a version that resolves this vulnerability.Fixed in 5.9-0ubuntu0.22.04.8 - Upgrade
Upgrade
ubuntu/squidto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which deployments should be prioritized based on the named affected software?
Inventory Ubuntu systems running the squid or squid-openssl packages, as well as Squid deployments identified in the advisory. The listed issues include remotely triggered request smuggling, denial-of-service, and information-disclosure impacts.
Are all of the listed issues limited to the same Ubuntu releases?
No. The cache-digest buffer overflow, FTP directory-listing parsing issue, and the listed ICP traffic issues are stated to affect only Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. No equivalent Ubuntu release limitation is stated for the HTTP Transfer-Encoding request-smuggling issue.