# Ubuntu patches five Squid vulnerabilities including HTTP request smuggling

> **Key takeaway:** Ubuntu has released security updates for Squid addressing five vulnerabilities, including HTTP request smuggling, buffer overflows, and denial-of-service conditions affecting multiple LTS releases.

**Published:** 2026-10-20T13:59:52+00:00 
**Source:** Ubuntu Security & Release Notices 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/ubuntu-patches-five-squid-vulnerabilities-including-http-req.html 

## Summary
Ubuntu published USN-8941-1 to fix five Squid vulnerabilities. CVE-2026-61642 allows HTTP request smuggling, cache poisoning, and security bypass through malformed Transfer-Encoding headers. Four additional CVEs affect only Ubuntu 16.04, 18.04, and 20.04 LTS: two buffer overflow/cache digest issues (CVE-2026-50012), an FTP directory listing information leak (CVE-2026-47729), and two ICP-related denial-of-service and information disclosure flaws (CVE-2026-32748, CVE-2026-33526, CVE-2026-33515).

## Vulnerability breakdown by affected release
- **CVE-2026-61642** (all supported releases): HTTP Transfer-Encoding header mishandling enables request smuggling, cache poisoning, and WAF/security bypass
- **CVE-2026-50012** (16.04/18.04/20.04 LTS only): Cache digest reply buffer overflow → DoS via crash
- **CVE-2026-47729** (16.04/18.04/20.04 LTS only): FTP directory listing parsing flaw → sensitive information disclosure
- **CVE-2026-32748, CVE-2026-33526** (16.04/18.04/20.04 LTS only): ICP traffic handling bugs → DoS crashes
- **CVE-2026-33515** (16.04/18.04/20.04 LTS only): ICP request parsing flaw → sensitive information disclosure
- Older LTS releases carry disproportionate risk: four of five CVEs are exclusive to ESM-supported versions

## Why it matters
Squid remains widely deployed in enterprise networks, educational institutions, and caching infrastructure. The HTTP request smuggling vulnerability affects all supported Ubuntu releases and poses particular risk to environments using Squid as a reverse proxy or forward proxy with security inspection. Organizations on older LTS releases face compounded exposure with four additional CVEs.