Multiple Vulnerabilities in Squid Proxy

The French National Cybersecurity Agency (ANSSI) has released an advisory regarding multiple critical vulnerabilities affecting the Squid web proxy cache, specifically impacting all versions prior to 7.7. These vulnerabilities pose significant risks, including remote denial-of-service (DoS) attacks, unauthorized manipulation of cached data, and the circumvention of established security policies. The issues were documented via several GitHub Security Advisories (GHSA-537g-4gfh-w7m6, GHSA-j9pf-q9f6-v44c, and GHSA-vh99-xw7j-fx5c) and are tracked under CVE-2026-61642. Given the role of Squid as a central gateway for enterprise web traffic, exploitation of these flaws could allow an attacker to disrupt organizational connectivity or intercept and modify proxied traffic. Organizations currently running versions of Squid older than 7.7 should prioritize testing and deployment of the patches provided by the maintainers.

Impact

Successful exploitation of these vulnerabilities can lead to service outages impacting all users routing through the affected proxy, as well as the loss of data integrity for cached resources. By bypassing security policies, an attacker may be able to reach internal restricted resources or exfiltrate data by evading access control lists (ACLs) enforced at the proxy level. Given the widespread deployment of Squid in enterprise environments, the potential for broad disruption is substantial.

Recommendation

• Upgrade all instances of Squid proxy to version 7.7 or later immediately to resolve the vulnerabilities referenced in GHSA-537g-4gfh-w7m6, GHSA-j9pf-q9f6-v44c, and GHSA-vh99-xw7j-fx5c.
• Review Squid access logs and error logs for anomalous spikes in request failure rates or unexpected response codes (e.g., frequent 5xx errors) that may indicate exploitation attempts targeting DoS vulnerabilities.
• Implement network-level access controls to restrict management access to the proxy server to authorized administrative IP addresses only.