Squid Proxy Flaws Enable Cache Poisoning and Out of Bounds Writes

Three vulnerabilities in the Squid caching proxy could enable HTTP request smuggling or out-of-bounds writes, potentially allowing cache poisoning and the delivery of malicious content to clients. The request-smuggling issue, CVE-2026-61642, stems from inadequate enforcement of HTTP/1.1 `Transfer-Encoding` behaviour. The article says attackers could use it to bypass security controls and store arbitrary payloads in a cache.

The other flaws, identified as SQUID-2026:8 and SQUID-2026:7, are stack-based buffer overflows caused by insufficient input validation. SQUID-2026:8 can be triggered through an external ACL helper by supplying excessively long username and password annotations during ICAP authentication. SQUID-2026:7 affects basic HTTP authentication with a peer server and can likewise be used by trusted clients to cause an out-of-bounds write. No active exploitation or public proof-of-concept has been confirmed for the vulnerabilities, according to the report.

CVE-2026-61642 affects Squid versions 3.3.0.1 through 7.5, while both buffer overflows affect versions 3.0 through 7.7. Squid fixed the request-smuggling vulnerability in version 7.6 and the buffer overflows in version 7.7. Administrators should upgrade to the applicable fixed release and consult the project’s security advisories. Where an immediate upgrade is not possible, the article suggests limiting username lengths or using alternative authentication methods.