[squid-announce] [ADVISORY] SQUID-2026:7 Stack Buffer Overflow in HTTP Authentication

[Amos Jeffries]

__________________________________________________________________

     Squid Proxy Cache Security Update Advisory SQUID-2026:7
__________________________________________________________________

  Advisory ID:       | SQUID-2026:7
  Date:              | 2026-07-30
  Summary:           | Stack Buffer Overflow in HTTP Authentication
  Affected versions: | Squid 4.0.1 -> 4.17
                     | Squid 5.x -> 5.9
                     | Squid 6.x -> 6.14
                     | Squid 7.x -> 7.6
  Fixed in version:  | Squid 7.7
__________________________________________________________________

Problem Description:

  Due to an Improper Input Validation (CWE-20) bug
  Squid is vulnerable to a Stack-based Buffer Overflow (CWE-121)
  attack against HTTP Authentication.

__________________________________________________________________

Severity:

  This problem allows a trusted client to perform an
  out-of-bounds write when squid is configured to authenticate
  with a peer server using client provided Basic authentication
  credentials.

  This attack is limited to squid deployments passing client
  supplied Basic authentication credentials to a cache_peer.

__________________________________________________________________

Updated Packages:

  This bug is fixed by Squid version 7.7

  In addition, patches addressing this problem for the stable
  releases can be found in our patch archives:

  Squid 7:
  <https://github.com/squid-cache/squid/commit/8b3c2f2eea22886288edb47d4c30177bf8673650.patch>

  If you are using a prepackaged version of Squid then please
  refer to the package vendor for availability information on
  updated packages.

__________________________________________________________________

Determining if your version is vulnerable:

  Squid older than 3.5.28 have not been tested but should be
  considered not vulnerable.

  All Squid-4.x up to and including 4.17 are not vulnerable.

  For Squid-5 and newer run the command:

   squid -k parse 2>&1 | \
     grep -E "cache_peer.*login=(\*:|PASS)" || \
     echo "not vulnerable"


  All Squid-5.x up to and including 5.9 are vulnerable when
  passing traffic to any cache_peer listed by the above command.

  All Squid-6.x up to and including 6.14 are vulnerable when
  passing traffic to any cache_peer listed by the above command.

  All Squid-7.x up to and including 7.6 are vulnerable when
  passing traffic to any cache_peer listed by the above command.

__________________________________________________________________

Workaround:

  Among the possible workarounds:

  * Use a different form of authentication in the cache_peer such
    as for instance a src type ACL.

  * restrict the length of allowed usernames, for instance using:

   acl long_username proxy_auth_regex ^.{100,}$
   http_access deny long_username_check

__________________________________________________________________

Contact details for the Squid project:

  For installation / upgrade support on binary packaged versions
  of Squid: Your first point of contact should be your binary
  package vendor.

  If you install and build Squid from the original Squid sources
  then the <squid-users at lists.squid-cache.org> mailing list is
  your primary support point. For subscription details see
  <https://www.squid-cache.org/Support/mailing-lists.html>.

  For reporting of non-security bugs in the latest STABLE release
  the squid bugzilla database should be used
  <https://bugs.squid-cache.org/>.

  For reporting of security sensitive bugs send an email to the
  <squid-bugs at lists.squid-cache.org> mailing list. It's a closed
  list (though anyone can post) and security related bug reports
  are treated in confidence until the impact has been established.

__________________________________________________________________

Credits:

  This vulnerability was discovered by:
  breakingbad6, Yingpei Zeng and Yanzhao Shen

  Fixed by Francesco Chemolli <<kinkie at squid-cache.org>>

__________________________________________________________________

Revision history:

  2026-05-09 18:29:00 UTC Initial report
  2026-06-23 07:00:00 UTC Patch published
  2026-08-09 21:00:00 UTC Advisory drafted

__________________________________________________________________
END