Ubuntu patches Squid HTTP request smuggling flaws in 26.04 LTS

Ubuntu has released USN-8998-1 to address a vulnerability in Squid, the widely deployed open-source web proxy cache server. The flaw, tracked as CVE-2026-61642, stems from incorrect processing of certain HTTP Transfer-Encoding headers and affects Ubuntu 26.04 LTS (Resolute). An unauthenticated remote attacker could exploit this weakness to conduct HTTP request smuggling attacks, circumvent security controls, or poison web caches.

The fix is available in squid version 7.7-0ubuntu0.26.04.2. Ubuntu advises that standard system updates will apply the necessary changes. This notice follows an earlier related advisory, USN-8941-1, suggesting either a coordinated disclosure or an incomplete initial patch for this attack surface.

Vulnerability details and attack vectors

• CVE identifier: CVE-2026-61642 is the assigned identifier for this Squid vulnerability.
• Defect class: HTTP request smuggling arising from improper parsing of HTTP Transfer-Encoding headers.
• Attack vector: Remote and unauthenticated; attackers can manipulate request boundaries to desynchronize Squid from backend servers.
• Impact scope: Successful exploitation enables HTTP request smuggling, security mechanism bypass, and web cache poisoning.
• Fixed version: squid 7.7-0ubuntu0.26.04.2 for Ubuntu 26.04 LTS (Resolute).

Why it matters

Squid remains a foundational component in enterprise networks, content delivery networks, and Linux-based proxy deployments, making this vulnerability relevant for system administrators managing traffic inspection or caching layers. The cache poisoning vector is particularly consequential for distributions and organizations relying on Squid for upstream package caching or transparent proxying, as corrupted caches could serve malicious content to downstream clients.