CVE-2026-61642

A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP cache operates in front of the affected Squid instance, the attacker can also poison that cache, causing it to store and deliver malicious content to other users.

This vulnerability is rated as having an Important severity because it allows network clients to bypass proxy security controls and poison shared web caches without requiring administrative privileges. In deployments where Squid acts as an intermediary or accelerator alongside HTTP caching layers, request desynchronization caused by specially crafted HTTP/1.1 Transfer-Encoding headers can lead to widespread cache contamination affecting other users. While exploitation requires client access to the proxy service, the resulting integrity impact across shared infrastructure justifies the Important rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, administrators should enforce rigorous server-side HTTP header validation by explicitly denying conflicting or ambiguous framing requests. In your squid.conf, this can be temporarily achieved by rejecting the problematic encoding outright using the directive request_header_access Transfer-Encoding deny all. Alternatively, administrators can neutralize the request smuggling attack vector entirely by disabling connection reuse with the settings client_persistent_connections off and server_persistent_connections off.