The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8941-1 advisory.

    It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker     could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or     poison web caches.

    (CVE-2026-61642)

    It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a     buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a     denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS.
    (CVE-2026-50012)

    It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker     could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS,     Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729)

    It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use     this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu     16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526)

    It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly     use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04     LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784713308 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786353802 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4909-1 advisory.

    - CVE-2023-5824: Multiple issues in HTTP response caching (bsc#1216496).
    - CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature (bsc#1217825).
    - CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads to the     disclosure of       credentials a trusted client uses to authenticate (bsc#1252281).
    - CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
    - CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
    - CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
    - CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of     syntactic       correctness of input (bsc#1268272).
    - CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

Note that Nessus relies on the presence of the package as reported by the vendor.

The CentOS Linux 8.5 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784987022 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787042235 advisory.

  - An issue was discovered in Squid before 4.9. URN response handling in Squid suffers from a heap-based     buffer overflow. When receiving data from a remote server in response to an URN request, Squid fails to     ensure that the response can fit within the buffer. This leads to attacker controlled data overflowing in     the heap. (CVE-2019-12526)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1784986918 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-152917 advisory.

    Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6360 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6360-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 6.13-2+deb13u2.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4697 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4697-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 24, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : squid     Version        : 4.13-10+deb11u7 5.7-2+deb12u6     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729                      CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of     service.

    For Debian 11 bullseye, these problems have been fixed in version     4.13-10+deb11u7.

    For Debian 12 bookworm, these problems have been fixed in version     5.7-2+deb12u6.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784801979 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784801979 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
369509	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Squid vulnerabilities (USN-8941-1)	Nessus	Ubuntu Local Security Checks	2026/10/21	2026/10/22	critical
360446	CentOS Linux 8.4 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1784713308)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
362348	CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786353802)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
372261	SUSE SLES15 Security Update : squid (SUSE-SU-2026:4909-1)	Nessus	SuSE Local Security Checks	2026/10/27	2026/10/28	critical
320881	Linux Distros Unpatched Vulnerability : CVE-2026-47729	Nessus	Misc.	2026/6/12	2026/11/6	medium
352564	CentOS Linux 8.5 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1784987022)	Nessus	CentOS Local Security Checks	2026/9/30	2026/9/30	medium
359908	CentOS Linux 6 [TuxCare] Security Update: squid34 Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787042235)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/28	critical
360744	CentOS Linux 8 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784986918)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	medium
379815	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-152917)	Nessus	Unity Linux Local Security Checks	2026/11/12	2026/11/12	medium
321872	Debian dsa-6360 : squid - security update	Nessus	Debian Local Security Checks	2026/6/21	2026/7/23	critical
329264	Debian dla-4697 : squid - security update	Nessus	Debian Local Security Checks	2026/7/23	2026/7/23	critical
361426	AlmaLinux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784801979)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	medium
362330	Rocky Linux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784801979)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	medium

偵測

搜尋 Plugin

critical

medium

medium

critical

medium

medium

critical

medium

medium

critical

critical

medium

medium