Back to Security Advisories

Squid Vulnerability — Ubuntu Security Update (USN-8998-1)

USN-8998-1 fixes CVE-2026-61642 in Squid on Ubuntu: improper handling of HTTP Transfer-Encoding headers allows HTTP request-smuggling attacks, bypassing security mechanisms or poisoning web caches (CVSS 7.7, CWE-444). Update: sudo apt update && sudo apt upgrade squid and restart the service.

High 7.7 CVSS
Ubuntu 20.04 Ubuntu 22.04

What this means under a SharedLicense license

Request smuggling through a cache proxy poisons cached responses for other users and can bypass front-end access controls — the cached content every downstream visitor sees becomes attacker-controlled.

  1. Ubuntu Security Notices

  2. USN-8996-1

Publication date

4 November 2026

Overview

APT could be made to install unverified packages and run programs as an
administrator

Releases


26.10


26.04 LTS


24.04 LTS


22.04 LTS


20.04 LTS


18.04 LTS


16.04 LTS


14.04 LTS

Packages

  • apt – Advanced front-end for dpkg

Details

Max Justicz discovered that APT incorrectly handled hard links when
encountering redirects and retrying package downloads. A remote on-path
attacker could possibly use this issue to trick APT into installing an
unverified package and achieve remote code execution with root privileges.

Max Justicz discovered that APT incorrectly handled hard links when
encountering redirects and retrying package downloads. A remote on-path
attacker could possibly use this issue to trick APT into installing an
unverified package and achieve remote code execution with root privileges.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
26.10

stonking

 apt – 

3.3.3ubuntu0.1
26.04

LTS resolute

 apt – 

3.2.1ubuntu0.1
24.04

LTS noble

 apt – 

2.8.4ubuntu0.1
22.04

LTS jammy

 apt – 

2.4.15ubuntu0.1
20.04

LTS focal

 apt – 

2.0.12+esm1

Ubuntu Pro
Fix available with Ubuntu Pro.
18.04

LTS bionic

 apt – 

1.6.19+esm1

Ubuntu Pro
Fix available with Ubuntu Pro.
16.04

LTS xenial

 apt – 

1.2.36+esm1

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.
14.04

LTS trusty

 apt – 

1.0.1ubuntu2.24+esm4

Ubuntu Pro
Fix available with Ubuntu Pro via Legacy Support add-on.

References

Frequently Asked Questions

What is CVE-2026-61642?
It is an HTTP request-smuggling flaw in Squid caused by improper handling of Transfer-Encoding headers: conflicting interpretations of request boundaries let an attacker bypass security mechanisms or poison cached responses. CVSS 7.7, CWE-444; fixed in USN-8998-1.
Who is affected?
Ubuntu servers running Squid as a forward or reverse proxy — especially deployments where Squid sits in front of applications with their own security controls or caches responses shared between users.
How do I apply the fix?
Run sudo apt update && sudo apt upgrade squid and restart the squid service. Review the cache for poisoned entries after updating if the proxy served cached content publicly.
What is request smuggling in one sentence?
Front-end and back-end systems disagree on where one HTTP request ends and the next begins, so the attacker's smuggled request slips past the front-end's security checks and is processed by the back-end as a separate request.

References

Security Advisories

Related Advisories

Tornado Regression — Ubuntu Security Update (USN-8952-3)

2026-11-11

Linux Kernel (Azure CVM) Vulnerabilities — Ubuntu Security Update (USN-9039-1)

2026-11-11

Linux Kernel (Low Latency NVIDIA) Vulnerabilities — Ubuntu Security Update (USN-9040-1)

2026-11-11

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System