CVE-2026-61642: Squid Proxy HTTP Request Smuggling Flaw

CVE-2026-61642 Overview

CVE-2026-61642 is an HTTP Request Smuggling vulnerability in Squid, the widely deployed caching proxy for the Web. The flaw affects Squid versions from 3.3.0.1 up to (but not including) 7.6. The HTTP header parser in src/HttpHeader.cc accepts the bare Transfer-Encoding: identity form, which the HTTP/1.1 specification prohibits outside of chunked encoding. A trusted client can abuse this parsing behavior to smuggle a second request past upstream security controls. When a shared HTTP cache sits in front of Squid, the attacker can poison that cache and serve arbitrary content to other clients.

Critical Impact
Attackers can bypass security controls between client and Squid, and poison upstream HTTP caches to deliver malicious content at arbitrary URLs to other users.

Affected Products

Squid caching proxy versions 3.3.0.1 through 7.5
Deployments terminating HTTP/1.1 traffic with Transfer-Encoding processing
Squid instances deployed behind or in front of shared HTTP caches

Discovery Timeline

2026-10-13 - CVE CVE-2026-61642 published to NVD
2026-10-13 - Last updated in NVD database
Squid 7.6 - Fix released via commits d06f48de and d808a7c8 (pull requests #2427 and #2431)

Technical Details for CVE-2026-61642

Vulnerability Analysis

The vulnerability is classified as HTTP Request Smuggling under CWE-444: Inconsistent Interpretation of HTTP Requests. Squid's HTTP/1.1 parser accepts Transfer-Encoding: identity and silently removes the header via delById(Http::HdrType::TRANSFER_ENCODING). The HTTP specification requires any transfer coding other than chunked to be wrapped inside chunked encoding. When Squid strips the header while an upstream or downstream proxy interprets it differently, the two systems disagree on where one request ends and the next begins. An attacker leverages this desynchronization to inject a second request that the fronting proxy never saw.

Root Cause

The root cause is an improper enforcement of HTTP/1.1 behavioral workflow in src/HttpHeader.cc. The legacy branch that treated identity as a deprecated no-op transfer coding allowed malformed headers to pass validation. This permitted conflicting interpretations between Squid and adjacent HTTP intermediaries, enabling smuggling.

Attack Vector

Exploitation requires a trusted client that can send HTTP/1.1 requests through Squid. The attacker crafts a request containing Transfer-Encoding: identity alongside a Content-Length header or additional pipelined content. Squid drops the Transfer-Encoding header and processes the body one way, while an upstream cache or proxy interprets it differently. When an HTTP cache sits in front of Squid, the smuggled request can poison cached responses so that unrelated users receive attacker-controlled content on future requests to arbitrary URLs.

text

// Patch from src/HttpHeader.cc - removal of the permissive identity branch
         if (rawTe.caseCmp("chunked") == 0) {
             ; // leave header present for chunked() method
-        } else if (rawTe.caseCmp("identity") == 0) { // deprecated. no coding
-            delById(Http::HdrType::TRANSFER_ENCODING);
         } else {
             // This also rejects multiple encodings until we support them properly.
             debugs(55, warnOnError, "WARNING: unsupported Transfer-Encoding used by client: " << rawTe);

Source: GitHub commit d06f48de

Detection Methods for CVE-2026-61642

Indicators of Compromise

HTTP requests containing Transfer-Encoding: identity headers reaching Squid proxies.
Requests presenting both Transfer-Encoding and Content-Length headers in the same message.
Cache entries serving unexpected content at URLs that previously returned benign responses.
Squid access logs showing anomalous pipelined requests from a single client connection.

Detection Strategies

Inspect proxy and WAF logs for the literal string Transfer-Encoding: identity, which is non-compliant and should not appear in legitimate traffic.
Correlate upstream cache responses against origin server content to identify poisoned cache entries.
Alert on HTTP/1.1 requests that combine Transfer-Encoding and Content-Length headers through generic WAF or IDS signatures.

Monitoring Recommendations

Enable verbose Squid logging (debug_options ALL,2) to capture the unsupported Transfer-Encoding warnings emitted by patched builds.
Baseline cache hit ratios and content hashes so sudden shifts can be reviewed as potential poisoning events.
Forward Squid, upstream cache, and origin logs into a centralized analytics platform for cross-tier correlation.

How to Mitigate CVE-2026-61642

Immediate Actions Required

Upgrade Squid to version 7.6 or later, where the identity transfer coding branch is removed.
Audit upstream and downstream HTTP intermediaries for independent request smuggling defenses.
Purge or invalidate shared HTTP caches that sit in front of vulnerable Squid instances to clear potentially poisoned entries.
Restrict HTTP/1.1 proxy access to authenticated or trusted clients where feasible.

Patch Information

The fix is included in Squid 7.6. Review the Squid Security Advisory GHSA-537g-4gfh-w7m6, the SQUID_7_6 release notes, and pull requests #2427 and #2431 for implementation details.

Workarounds

Deploy a front-end reverse proxy or WAF that rejects requests containing Transfer-Encoding: identity.
Block HTTP/1.1 requests that present both Transfer-Encoding and Content-Length headers simultaneously.
Terminate client connections after a single request to limit smuggling via pipelining until patching is complete.

bash

# Example WAF rule concept to drop non-compliant Transfer-Encoding values
# (ModSecurity-style pseudocode)
SecRule REQUEST_HEADERS:Transfer-Encoding "@rx (?i)identity" \
    "id:1006164,phase:1,deny,status:400,msg:'Blocked Transfer-Encoding: identity (CVE-2026-61642)'"