CVE-2026-61642

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-61642

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61642.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-61642

Aliases

GHSA-537g-4gfh-w7m6

Downstream

Published

2026-10-13T16:29:37Z

Modified

2026-10-15T02:47:33Z

Severity

7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVSS Calculator

Summary

Squid Request Smuggling in HTTP Transfer-Encoding

Details

Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (src/HttpHeader.cc) accepted the bare Transfer-Encoding: identity form, which the HTTP specification prohibits because any transfer coding must be wrapped within chunked encoding. This problem allows a trusted client to perform an HTTP Request Smuggling attack when HTTP/1.1 is used, bypassing security mechanisms that may be in place between attacker and Squid. When there is an HTTP cache operating prior to the affected Squid, this Request Smuggling attack also allows the attacker to poison that web cache and store arbitrary malicious content at any URL for delivery to other clients' future requests. This issue is fixed in version 7.6.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-444"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61642.json"
}

References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type

GIT

Repo

https://github.com/squid-cache/squid

Events

Introduced

b6bc3157c337458cd6615fd2120fa5446f82d1c3

Fixed

a440c2af73b394fc31539a4f85bfb5d5ed47dd9a

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "3.3.0.1"
        },
        {
            "fixed":  "7.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61642.json"