CVE-2026-61642
Description
A flaw was found in Squid. Due to improper handling of HTTP/1.1 Transfer-Encoding headers, a trusted client can perform an HTTP request smuggling attack, interfering with how web requests are processed. This vulnerability allows an attacker to bypass intermediate security controls. When an HTTP cache operates in front of the affected Squid instance, the attacker can also poison that cache, causing it to store and deliver malicious content to other users.
Statement
This vulnerability is rated as having an Important severity because it allows network clients to bypass proxy security controls and poison shared web caches without requiring administrative privileges. In deployments where Squid acts as an intermediary or accelerator alongside HTTP caching layers, request desynchronization caused by specially crafted HTTP/1.1 Transfer-Encoding headers can lead to widespread cache contamination affecting other users. While exploitation requires client access to the proxy service, the resulting integrity impact across shared infrastructure justifies the Important rating.
Mitigation
To mitigate this vulnerability, administrators should enforce rigorous server-side HTTP header validation by explicitly denying conflicting or ambiguous framing requests. In your squid.conf, this can be temporarily achieved by rejecting the problematic encoding outright using the directive request_header_access Transfer-Encoding deny all. Alternatively, administrators can neutralize the request smuggling attack vector entirely by disabling connection reuse with the settings client_persistent_connections off and server_persistent_connections off.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | None | N/A | None |
| Integrity Impact | High | N/A | High |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Understanding the Weakness (CWE)
Other
Technical Impact: Alter Execution Logic
An attacker could cause the product to skip critical steps or perform them in the wrong order, bypassing its intended business logic. This can sometimes have security implications.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
