## What Happened
Multiple high-severity vulnerabilities in the Squid proxy allow attackers to perform request smuggling and trigger stack buffer overflows. The request smuggling flaw is tracked as CVE-2026-61642, and two additional issues are referenced as SQUID-2026:8 and SQUID-2026:7.
## Technical Details
- CVE-2026-61642: Improper enforcement of HTTP/1.1 Transfer-Encoding handling enables request smuggling. This can allow trusted clients to bypass security mechanisms and place arbitrary malicious payloads into the web cache.
- SQUID-2026:8: Stack-based buffer overflow via an external ACL helper, achievable by supplying excessively long user/password annotations during ICAP authentication, leading to an out-of-bounds write.
- SQUID-2026:7: Stack-based buffer overflow during basic HTTP authentication with a peer server, where trusted clients can trigger an out-of-bounds write.
- Researchers report no active in-the-wild exploitation and no public proof-of-concept at the time of the advisory.
## Affected
- Request smuggling (CVE-2026-61642): Squid versions 3.3.0.1 through 7.5.
- Buffer overflows (SQUID-2026:8 and SQUID-2026:7): Squid versions 3.0 through 7.7.
## Impact
- Request smuggling can lead to unauthorized cache poisoning and distribution of malicious content to clients.
- Buffer overflows can result in out-of-bounds writes, potentially enabling memory corruption impacts depending on exploitation conditions.
## Mitigation
1. Upgrade Squid: the HTTP smuggling issue is resolved in 7.6, and the buffer overflow issues are fixed in 7.7.
2. If immediate upgrades are not possible, apply temporary mitigations such as restricting allowed username length or switching to alternate authentication methods.
3. Follow the official Squid security advisories repository for patch guidance and deployment-specific details.