*** This bug is a security vulnerability *** Public security bug reported:
Package: squid 7.2-2ubuntu2.2 Release: Ubuntu 26.04.1 LTS (amd64) [ Impact ] Squid exits with a fatal error when a request URL contains a "%" that is not followed by two hex digits and an ACL that decodes the URL is evaluated. The built-in "manager" ACL is a url_regex, so a forward proxy whose http_access rules mention "manager" (as in the stock squid.conf) is affected. Every in-flight connection is dropped when squid exits. A single malformed request from any client can restart squid. Log lines (cache.log), twice within one minute on a public forward proxy: FATAL: invalid pct-encoded triplet exception location: Uri.cc(102) Decode [ Test Plan ] On squid 7.2-2ubuntu2.2 with the stock http_access rules that mention the built-in manager ACL: 1. Send a forward-proxy request whose URL contains a "%" that is not followed by two hex digits, so that the manager ACL is evaluated. 2. Confirm cache.log shows "FATAL: invalid pct-encoded triplet" from Uri.cc Decode and that squid exits. After the patched package, repeat that request. Squid should stay up, and cache.log should not show that FATAL line. A url_regex or urllogin ACL should be evaluated against the raw URL. [ Where problems could occur ] The patch changes the failure path of Uri::Decode, which url_regex and urllogin use. A URL whose percent-encoding is valid is still decoded before the match. A URL with an invalid triplet is matched raw, instead of killing the process. An ACL tuned to the old mangled form of a bad URL can match differently. Valid URLs are unchanged. [ Other Info ] Upstream: https://bugs.squid-cache.org/show_bug.cgi?id=5501 Fixed upstream in Squid 7.5 (March 2026). Not fixed in 7.4. Uri::Decode returns no value on a bad triplet instead of throwing. url_regex and urllogin then use DecodeOrDupe, which keeps the raw URL. Commit: https://github.com/squid-cache/squid/commit/ad365edba79f043387446a36a930700ecc9d6d19 Stonking already has this via squid 7.7-1ubuntu1. Resolute security and updates are still 7.2-2ubuntu2.2 (orig tarball 7.2). The 7.2-2ubuntu2.2 changelog is CVE-2026-47729 and CVE-2026-50012, not bug 5501. Please backport this change to 26.04. This is a request to cherry-pick the fix, not to move Resolute onto a newer upstream release. Workaround: avoid ACLs that call Uri::Decode (url_regex, urllogin), for example deny manager URLs with urlpath_regex instead of the built-in "manager" ACL. ** Affects: squid (Ubuntu) Importance: Undecided Status: Fix Released ** Affects: squid (Ubuntu Resolute) Importance: Undecided Status: New ** Changed in: squid (Ubuntu) Status: New => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2169872 Title: squid 7.2: fatal "invalid pct-encoded triplet" in Uri::Decode kills squid (upstream bug 5501, fixed in 7.5) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/squid/+bug/2169872/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
