Squid: six vulnerabilities patched on Ubuntu, critical flaw enables request smuggling

Ubuntu issued USN-8941-1 on 20 October 2026, addressing six vulnerabilities in the Squid package, a caching proxy deployed on numerous Linux installations as both an enterprise forward proxy and a reverse cache in front of web backends. It affects all supported LTS series, from 16.04 through 24.04.\n\n## The most critical flaw: request smuggling\n\nSquid was found to handle certain HTTP Transfer-Encoding headers incorrectly. An attacker could exploit this issue to conduct HTTP request smuggling attacks, bypass security mechanisms or poison web caches (CVE-2026-61642). Squid's upstream advisory clarifies that the issue allows a trusted client to perform an HTTP Request Smuggling attack when using HTTP/1.1, circumventing security mechanisms that may exist between the attacker and Squid. When an HTTP cache operates in front of Squid, the attack also enables poisoning of that cache and storing arbitrary malicious content under any URL, subsequently served to future requests from other clients. The CVSS 3.1 score assigned by the Squid project is 7.7 (high), with network vector, low complexity and no user interaction required. The discovery is credited to Mitchell Benjamin of Revamp Studio; upstream, the fix arrived with Squid 7.6 release, whilst Ubuntu opted for a targeted backport within packages for already-distributed series, avoiding a major version jump.\n\nThe other five CVEs affect only older releases (16.04, 18.04, 20.04): a buffer overflow in cache digest response handling that can cause service crash (CVE-2026-50012), a parsing error in FTP directory listing that exposes sensitive information (CVE-2026-47729), two issues in ICP traffic handling leading to denial of service (CVE-2026-32748, CVE-2026-33526) and a bug in ICP requests that can leak data (CVE-2026-33515).\n\n## Patched versions\n\n| Release | Package | Fixed version |\n|---|---|---|\n| 24.04 LTS (noble) | squid / squid-openssl | 6.14-0ubuntu0.24.04.5 |\n| 22.04 LTS (jammy) | squid / squid-openssl | 5.9-0ubuntu0.22.04.8 |\n| 20.04 LTS (focal) | squid | 4.10-1ubuntu1.13+esm3 (requires Ubuntu Pro) |\n| 18.04 LTS (bionic) | squid | 3.5.27-1ubuntu1.14+esm6 (requires Ubuntu Pro) |\n| 16.04 LTS (xenial) | squid | 3.5.12-1ubuntu7.16+esm7 (requires Ubuntu Pro, Legacy Support add-on) |\n\nFor those running Squid as a reverse proxy in front of a CDN or backend cluster, the concrete risk is cache poisoning: malicious content served to all subsequent clients until the entry expires or is manually invalidated. Those on 24.04 or 22.04 need only sudo apt update && sudo apt install --only-upgrade squid; users still on 20.04, 18.04 or 16.04 must have an active Ubuntu Pro subscription to receive the patch.\n\nSource: official Ubuntu security advisory USN-8941-1, 20 October 2026.