CVE-2026-61642
Squid Request Smuggling in HTTP Transfer-Encoding
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Squid Request Smuggling in HTTP Transfer-Encoding
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
CVE-2026-61642- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
EUVDEUVD-2026-98919
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
EUVD-2026-98919- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
NVD
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
CVE-2026-61642- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSV
Squid Request Smuggling in HTTP Transfer-Encoding
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
CVE-2026-61642- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-444
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-61642
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
DEBIAN-CVE-2026-61642- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-03
OSVOESA-2026-4580
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.(CVE-2026-61642)
- Record
OESA-2026-4580- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVOESA-2026-4581
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.(CVE-2026-61642)
- Record
OESA-2026-4581- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4582
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.(CVE-2026-61642)
- Record
OESA-2026-4582- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVOESA-2026-4583
squid security update
Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.
Security Fix(es):
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.(CVE-2026-61642)
- Record
OESA-2026-4583- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-61642
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
UBUNTU-CVE-2026-61642- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-05
OSVAZL-108531 No score
CVE-2026-61642 affecting package squid for versions less than 6.13-6
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.
- Record
AZL-108531- Updated
- 2026-11-06
OSVCLSA-2026-1792505835 No score
Fix CVE(s): CVE-2026-61642
- SECURITY UPDATE: HTTP request smuggling via Transfer-Encoding: identity
- debian/patches/CVE-2026-61642.patch: reject bare identity coding
- CVE-2026-61642
- Record
CLSA-2026-1792505835- Updated
- 2026-11-02
OSVCLSA-2026-1792517219 No score
squid: Fix of 2 CVEs
- CVE-2026-61642: reject bare Transfer-Encoding: identity to prevent HTTP request smuggling
- Record
CLSA-2026-1792517219- Updated
- 2026-11-02
OSVCLSA-2026-1792806435 No score
Fix CVE(s): CVE-2026-61642
- SECURITY UPDATE: request smuggling via Transfer-Encoding: identity
- debian/patches/CVE-2026-61642.patch: reject Transfer-Encoding: identity
- CVE-2026-61642
- Record
CLSA-2026-1792806435- Updated
- 2026-11-02
OSVUSN-8941-1 No score
squid, squid3 vulnerabilities
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642)
It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012)
It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729)
It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526)
It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)
- Record
USN-8941-1- Updated
- 2026-11-02
OSVUSN-8998-1 No score
squid vulnerability
It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.
- Record
USN-8998-1- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
squidAzure Linux:3 |
before 6.13-6 | 6.13-6 |
squidTuxCare:Ubuntu:20.04 |
before 4.10-1ubuntu1.13+tuxcare.els6 | 4.10-1ubuntu1.13+tuxcare.els6 |
squid-cgiTuxCare:Ubuntu:20.04 |
before 4.10-1ubuntu1.13+tuxcare.els6 | 4.10-1ubuntu1.13+tuxcare.els6 |
squid-commonTuxCare:Ubuntu:20.04 |
before 4.10-1ubuntu1.13+tuxcare.els6 | 4.10-1ubuntu1.13+tuxcare.els6 |
squid-purgeTuxCare:Ubuntu:20.04 |
before 4.10-1ubuntu1.13+tuxcare.els6 | 4.10-1ubuntu1.13+tuxcare.els6 |
squidclientTuxCare:Ubuntu:20.04 |
before 4.10-1ubuntu1.13+tuxcare.els6 | 4.10-1ubuntu1.13+tuxcare.els6 |
squidTuxCare:AlmaLinux:9.2 |
before 7:5.5-5.el9_2.1.tuxcare.els15 | 7:5.5-5.el9_2.1.tuxcare.els15 |
squidTuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
squid-cgiTuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
squid-commonTuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
squid-purgeTuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
squid3TuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
squidclientTuxCare:Debian:10 |
before 4.6-1+deb10u10+tuxcare.els6 | 4.6-1+deb10u10+tuxcare.els6 |
squidDebian:12 |
All versions, plus listed versions 5.7-25.7-2+deb12u15.7-2+deb12u25.7-2+deb12u35.7-2+deb12u4 Show 21 moreShow less5.7-2+deb12u55.7-2+deb12u66.1-16.1-26.10-16.12-16.13-16.13-26.3-16.5-16.6-16.8-16.9-17.1-17.2-17.2-27.4-17.5-17.6-17.6-27.7-1 |
None known |
squidDebian:13 |
before 6.13-2+deb13u4, plus listed versions 6.13-26.13-2+deb13u16.13-2+deb13u26.13-2+deb13u3 |
6.13-2+deb13u4 |
squidDebian:14 |
before 7.6-1, plus listed versions 6.13-27.1-17.2-17.2-27.4-17.5-1 |
7.6-1 |
squidopenEuler:24.03-LTS-SP4 |
before 6.6-10.oe2403sp4 | 6.6-10.oe2403sp4 |
squidopenEuler:22.03-LTS-SP4 |
before 4.9-33.oe2203sp4 | 4.9-33.oe2203sp4 |
squidopenEuler:24.03-LTS-SP1 |
before 6.6-10.oe2403sp1 | 6.6-10.oe2403sp1 |
squidopenEuler:24.03-LTS-SP3 |
before 6.6-10.oe2403sp3 | 6.6-10.oe2403sp3 |
squid3Ubuntu:Pro:16.04:LTS |
before 3.5.12-1ubuntu7.16+esm7, plus listed versions 3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1 Show 21 moreShow less3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.123.5.12-1ubuntu7.133.5.12-1ubuntu7.143.5.12-1ubuntu7.153.5.12-1ubuntu7.163.5.12-1ubuntu7.16+esm13.5.12-1ubuntu7.16+esm23.5.12-1ubuntu7.16+esm33.5.12-1ubuntu7.16+esm43.5.12-1ubuntu7.16+esm53.5.12-1ubuntu7.16+esm6 |
3.5.12-1ubuntu7.16+esm7 |
squid3Ubuntu:Pro:18.04:LTS |
before 3.5.27-1ubuntu1.14+esm6, plus listed versions 3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2 Show 17 moreShow less3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.133.5.27-1ubuntu1.143.5.27-1ubuntu1.14+esm13.5.27-1ubuntu1.14+esm23.5.27-1ubuntu1.14+esm33.5.27-1ubuntu1.14+esm43.5.27-1ubuntu1.14+esm5 |
3.5.27-1ubuntu1.14+esm6 |
squidUbuntu:Pro:20.04:LTS |
before 4.10-1ubuntu1.13+esm3, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 17 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.74.10-1ubuntu1.84.10-1ubuntu1.94.10-1ubuntu1.104.10-1ubuntu1.114.10-1ubuntu1.124.10-1ubuntu1.134.10-1ubuntu1.13+esm14.10-1ubuntu1.13+esm2 |
4.10-1ubuntu1.13+esm3 |
squidUbuntu:22.04:LTS |
before 5.9-0ubuntu0.22.04.8, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1 Show 12 moreShow less5.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.15.7-0ubuntu0.22.04.25.7-0ubuntu0.22.04.35.7-0ubuntu0.22.04.45.9-0ubuntu0.22.04.15.9-0ubuntu0.22.04.25.9-0ubuntu0.22.04.35.9-0ubuntu0.22.04.45.9-0ubuntu0.22.04.55.9-0ubuntu0.22.04.7 |
5.9-0ubuntu0.22.04.8 |
squidUbuntu:24.04:LTS |
before 6.14-0ubuntu0.24.04.5, plus listed versions 6.1-2ubuntu16.1-2ubuntu26.5-1ubuntu16.5-1ubuntu26.5-1ubuntu3 Show 10 moreShow less6.6-1ubuntu46.6-1ubuntu56.6-1ubuntu5.16.10-0ubuntu0.24.04.16.13-0ubuntu0.24.04.16.13-0ubuntu0.24.04.26.13-0ubuntu0.24.04.36.14-0ubuntu0.24.04.16.14-0ubuntu0.24.04.26.14-0ubuntu0.24.04.4 |
6.14-0ubuntu0.24.04.5 |
squidUbuntu:26.04:LTS |
before 7.7-0ubuntu0.26.04.2, plus listed versions 6.13-1ubuntu46.13-1ubuntu57.2-2ubuntu17.2-2ubuntu27.2-2ubuntu2.27.7-0ubuntu0.26.04.1 |
7.7-0ubuntu0.26.04.2 |
squid3Ubuntu:Pro:16.04:LTS From an advisory covering 6 CVEs |
before 3.5.12-1ubuntu7.16+esm7, plus listed versions 3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1 Show 21 moreShow less3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.123.5.12-1ubuntu7.133.5.12-1ubuntu7.143.5.12-1ubuntu7.153.5.12-1ubuntu7.163.5.12-1ubuntu7.16+esm13.5.12-1ubuntu7.16+esm23.5.12-1ubuntu7.16+esm33.5.12-1ubuntu7.16+esm43.5.12-1ubuntu7.16+esm53.5.12-1ubuntu7.16+esm6 |
3.5.12-1ubuntu7.16+esm7 |
squid3Ubuntu:Pro:18.04:LTS From an advisory covering 6 CVEs |
before 3.5.27-1ubuntu1.14+esm6, plus listed versions 3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2 Show 17 moreShow less3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.133.5.27-1ubuntu1.143.5.27-1ubuntu1.14+esm13.5.27-1ubuntu1.14+esm23.5.27-1ubuntu1.14+esm33.5.27-1ubuntu1.14+esm43.5.27-1ubuntu1.14+esm5 |
3.5.27-1ubuntu1.14+esm6 |
squidUbuntu:Pro:20.04:LTS From an advisory covering 6 CVEs |
before 4.10-1ubuntu1.13+esm3, plus listed versions 4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3 Show 17 moreShow less4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.74.10-1ubuntu1.84.10-1ubuntu1.94.10-1ubuntu1.104.10-1ubuntu1.114.10-1ubuntu1.124.10-1ubuntu1.134.10-1ubuntu1.13+esm14.10-1ubuntu1.13+esm2 |
4.10-1ubuntu1.13+esm3 |
squidUbuntu:22.04:LTS From an advisory covering 6 CVEs |
before 5.9-0ubuntu0.22.04.8, plus listed versions 4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1 Show 12 moreShow less5.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.15.7-0ubuntu0.22.04.25.7-0ubuntu0.22.04.35.7-0ubuntu0.22.04.45.9-0ubuntu0.22.04.15.9-0ubuntu0.22.04.25.9-0ubuntu0.22.04.35.9-0ubuntu0.22.04.45.9-0ubuntu0.22.04.55.9-0ubuntu0.22.04.7 |
5.9-0ubuntu0.22.04.8 |
squidUbuntu:24.04:LTS From an advisory covering 6 CVEs |
before 6.14-0ubuntu0.24.04.5, plus listed versions 6.1-2ubuntu16.1-2ubuntu26.5-1ubuntu16.5-1ubuntu26.5-1ubuntu3 Show 10 moreShow less6.6-1ubuntu46.6-1ubuntu56.6-1ubuntu5.16.10-0ubuntu0.24.04.16.13-0ubuntu0.24.04.16.13-0ubuntu0.24.04.26.13-0ubuntu0.24.04.36.14-0ubuntu0.24.04.16.14-0ubuntu0.24.04.26.14-0ubuntu0.24.04.4 |
6.14-0ubuntu0.24.04.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | ||
| affected, aliases, references | OSV | |
| affected | OSV | |
| affected, facts | OSV | |
| aliases | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-61642 is a high vulnerability (CVSS 7.7) in Squid-cache Squid, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.04%, the 81st percentile. Fixed in squid 6.13-6.
References
github.com/squid-cache/squid/security/advisories/GHSA-537g-4gfh-w7m6
Show 20 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-61642
errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1792505835.html
security-tracker.debian.org/tracker/CVE-2026-61642
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4580
ubuntu.com/security/CVE-2026-61642
cve.org/CVERecord?id=CVE-2026-61642