USN-8998-1: Ubuntu patches HTTP request smuggling flaw in Squid

Canonical released security advisory USN-8998-1 on 4 November 2026, which addresses an HTTP request smuggling flaw in Squid. This affects users who have deployed the proxy cache on Ubuntu 26.04 LTS: if Squid is running in production as a reverse proxy or HTTP cache in front of a website or service, the patch must be applied.

What the advisory says

The issue, identified as CVE-2026-61642, stems from incorrect handling of certain HTTP Transfer-Encoding headers. Canonical describes it as follows: Squid incorrectly handled certain HTTP Transfer-Encoding headers, and an attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches.

In the technical details published by the Squid project, the HTTP parser accepted a bare "Transfer-Encoding: identity" header, which the HTTP specification prohibits because any transfer coding must be encapsulated in chunked encoding. Affected versions range from 3.3.0.1 through to before 7.6, with a CVSS 3.1 score of 7.7 out of 10 (HIGH severity).

Package to update

Ubuntu Release	Package	Correct version
26.04 LTS (Resolute Raccoon)	squid	7.7-0ubuntu0.26.04.2

Those unable to update immediately can mitigate by configuring Squid to reject or strip unwrapped Transfer-Encoding: identity headers, as outlined in the technical recommendations linked to the CVE.

Context: not Squid's first patch this month

This is not the first Squid patch of the month: on 20 October 2026, Canonical had already released USN-8941-1, which addressed several security issues in Squid across Ubuntu 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS and 16.04 LTS. Those managing multiple Squid installations across different releases should therefore verify patch status across their entire infrastructure, not just 26.04.

What to do

On Ubuntu 26.04 LTS:

sudo apt update && sudo apt install --only-upgrade squid squid-openssl

After the update, the service must be restarted (systemctl restart squid) as the patch does not apply whilst running. For users on Ubuntu Pro, extended security coverage also applies to this package in the Main and Universe repositories.