__________________________________________________________________
Squid Proxy Cache Security Update Advisory SQUID-2026:7
__________________________________________________________________
Advisory ID: | SQUID-2026:7
Date: | 2026-07-30
Summary: | Stack Buffer Overflow in HTTP Authentication
Affected versions: | Squid 4.0.1 -> 4.17
| Squid 5.x -> 5.9
| Squid 6.x -> 6.14
| Squid 7.x -> 7.6
Fixed in version: | Squid 7.7
__________________________________________________________________
Problem Description:
Due to an Improper Input Validation (CWE-20) bug
Squid is vulnerable to a Stack-based Buffer Overflow (CWE-121)
attack against HTTP Authentication.
__________________________________________________________________
Severity:
This problem allows a trusted client to perform an
out-of-bounds write when squid is configured to authenticate
with a peer server using client provided Basic authentication
credentials.
This attack is limited to squid deployments passing client
supplied Basic authentication credentials to a cache_peer.
__________________________________________________________________
Updated Packages:
This bug is fixed by Squid version 7.7
In addition, patches addressing this problem for the stable
releases can be found in our patch archives:
Squid 7:
<https://github.com/squid-cache/squid/commit/8b3c2f2eea22886288edb47d4c30177bf8673650.patch>
If you are using a prepackaged version of Squid then please
refer to the package vendor for availability information on
updated packages.
__________________________________________________________________
Determining if your version is vulnerable:
Squid older than 3.5.28 have not been tested but should be
considered not vulnerable.
All Squid-4.x up to and including 4.17 are not vulnerable.
For Squid-5 and newer run the command:
squid -k parse 2>&1 | \
grep -E "cache_peer.*login=(\*:|PASS)" || \
echo "not vulnerable"
All Squid-5.x up to and including 5.9 are vulnerable when
passing traffic to any cache_peer listed by the above command.
All Squid-6.x up to and including 6.14 are vulnerable when
passing traffic to any cache_peer listed by the above command.
All Squid-7.x up to and including 7.6 are vulnerable when
passing traffic to any cache_peer listed by the above command.
__________________________________________________________________
Workaround:
Among the possible workarounds:
* Use a different form of authentication in the cache_peer such
as for instance a src type ACL.
* restrict the length of allowed usernames, for instance using:
acl long_username proxy_auth_regex ^.{100,}$
http_access deny long_username_check
__________________________________________________________________
Contact details for the Squid project:
For installation / upgrade support on binary packaged versions
of Squid: Your first point of contact should be your binary
package vendor.
If you install and build Squid from the original Squid sources
then the <[email protected]> mailing list is
your primary support point. For subscription details see
<https://www.squid-cache.org/Support/mailing-lists.html>.
For reporting of non-security bugs in the latest STABLE release
the squid bugzilla database should be used
<https://bugs.squid-cache.org/>.
For reporting of security sensitive bugs send an email to the
<[email protected]> mailing list. It's a closed
list (though anyone can post) and security related bug reports
are treated in confidence until the impact has been established.
__________________________________________________________________
Credits:
This vulnerability was discovered by:
breakingbad6, Yingpei Zeng and Yanzhao Shen
Fixed by Francesco Chemolli <<[email protected]>>
__________________________________________________________________
Revision history:
2026-05-09 18:29:00 UTC Initial report
2026-06-23 07:00:00 UTC Patch published
2026-08-09 21:00:00 UTC Advisory drafted
__________________________________________________________________
END
_______________________________________________
squid-announce mailing list
[email protected]
https://lists.squid-cache.org/listinfo/squid-announce
