CVE catalog

CVE-2026-61642

Squid vulnerabilities

Severity: Critical · CVSS 9.2
Published: Mar 24, 2026, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.22% · Oct 25, 2026

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/HttpHeader.cc`) accepted the bare` Transfer-Encoding:` identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	squid	sid	`7.7-1`	fixed
Debian	squid	forky	`7.7-1`	fixed
Debian	squid	trixie	`6.13-2+deb13u3`	vulnerable
Debian	squid	trixie-security	`6.13-2+deb13u2`	vulnerable
Debian	squid	bookworm	`5.7-2+deb12u5`	vulnerable
Debian	squid	bookworm-security	`5.7-2+deb12u6`	vulnerable
Ubuntu	squid	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-cgi	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-common	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-openssl	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid-purge	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squidclient	noble	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid3	pro	`3.5.23-5ubuntu1`	vulnerable
Ubuntu	squid3	pro	`3.5.23-5ubuntu2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.3`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.4`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.5`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.6`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.7`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.8`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.9`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.10`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.11`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.12`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.13`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm1`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm2`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm3`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm4`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm5`	vulnerable
Ubuntu	squid3	pro	`3.5.27-1ubuntu1.14+esm6`	fixed
Ubuntu	squid	pro	`4.8-1ubuntu2`	vulnerable
Ubuntu	squid	pro	`4.8-1ubuntu3`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu1`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu2`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu3`	vulnerable
Ubuntu	squid	pro	`4.9-2ubuntu4`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.2`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.3`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.4`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.5`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.6`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.7`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.8`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.9`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.10`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.11`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.12`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm1`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm2`	vulnerable
Ubuntu	squid	pro	`4.10-1ubuntu1.13+esm3`	fixed
Ubuntu	squid	22.04	`4.13-10ubuntu5`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu1`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu3`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.1`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.2`	vulnerable
Ubuntu	squid	22.04	`5.2-1ubuntu4.3`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.1`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.2`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.3`	vulnerable
Ubuntu	squid	22.04	`5.7-0ubuntu0.22.04.4`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.1`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.2`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.3`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.4`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.5`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.7`	vulnerable
Ubuntu	squid	22.04	`5.9-0ubuntu0.22.04.8`	fixed
Ubuntu	squid	24.04	`6.1-2ubuntu1`	vulnerable
Ubuntu	squid	24.04	`6.1-2ubuntu2`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu1`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu2`	vulnerable
Ubuntu	squid	24.04	`6.5-1ubuntu3`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu4`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu5`	vulnerable
Ubuntu	squid	24.04	`6.6-1ubuntu5.1`	vulnerable
Ubuntu	squid	24.04	`6.10-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.2`	vulnerable
Ubuntu	squid	24.04	`6.13-0ubuntu0.24.04.3`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.1`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.2`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.4`	vulnerable
Ubuntu	squid	24.04	`6.14-0ubuntu0.24.04.5`	fixed
Ubuntu	squid	26.04	`6.13-1ubuntu4`	vulnerable
Ubuntu	squid	26.04	`6.13-1ubuntu5`	vulnerable
Ubuntu	squid	26.04	`7.2-2ubuntu1`	vulnerable
Ubuntu	squid	26.04	`7.2-2ubuntu2`	vulnerable
Ubuntu	squid	26.04	`7.2-2ubuntu2.2`	vulnerable
Ubuntu	squid	26.04	`7.7-0ubuntu0.26.04.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	squid	source	sid	`7.6-1`	not yet assigned	Not reported	Not reported
Debian	squid	source	forky	`7.6-1`	not yet assigned	Not reported	Not reported
Debian	squid	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	squid	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported
Ubuntu	squid	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-cgi	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-common	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-openssl	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid-purge	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squidclient	deb	noble	`6.14-0ubuntu0.24.04.5`	Not reported	Not reported	Not reported
Ubuntu	squid3	deb	pro	`3.5.27-1ubuntu1.14+esm6`	Not reported	UBUNTU-CVE-2026-61642	Not reported
Ubuntu	squid	deb	pro	`4.10-1ubuntu1.13+esm3`	Not reported	UBUNTU-CVE-2026-61642	Not reported
Ubuntu	squid	deb	22.04	`5.9-0ubuntu0.22.04.8`	Not reported	UBUNTU-CVE-2026-61642	Not reported
Ubuntu	squid	deb	24.04	`6.14-0ubuntu0.24.04.5`	Not reported	UBUNTU-CVE-2026-61642	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[squid]Affected
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
[squid-cgi]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
[squidclient]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
[squid-common]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · all · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · all · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · all · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
[squid-openssl]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
[squid-purge]Affected
Source package: [squid]
Details (4)
- 5.7-2+deb12u5 · amd64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u5 · arm64 · bookworm
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · amd64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12
- 5.7-2+deb12u6 · arm64 · bookworm-security
  Affected
  usn · squid · debian · bookworm; usn · squid · debian · 12

[Debian 13 (Trixie)]

[squid]Affected
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Affected
  usn · squid · debian · 13
[squid-cgi]Affected
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Affected
  usn · squid · debian · 13
[squidclient]Affected
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Affected
  usn · squid · debian · 13
[squid-common]Affected
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · all · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · all · trixie-security
  Affected
  usn · squid · debian · 13
[squid-openssl]Affected
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Affected
  usn · squid · debian · 13
[squid-purge]Affected
Source package: [squid]
Details (4)
- 6.13-2+deb13u2 · amd64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · amd64 · trixie-security
  Affected
  usn · squid · debian · 13
- 6.13-2+deb13u2 · arm64 · trixie-security
  Affected
  usn · squid · debian · 13

Observed: Oct 27, 2026, 8:03:06 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]