CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – HTTP Cache Poisoning via Unkeyed Query Parameter Overview A web cache uses only the URL path as the cache key, ignoring query parameters. An attacker can append a malicious payload to an unkeyed parameter e.g., utmcampaign and poison the cache. Subsequent visitors receive the...

Web-Cache-Vulnerability-Scanner

Web Cache Vulnerability Scanner WCVS is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand. The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify...

param-miner

param-miner This extension identifies hidden, unlinked parameters. It's particularly useful for finding web cache poisoning vulnerabilities. It combines advanced diffing logic from Backslash Powered Scanner with a binary search technique to guess up to 65,000 param names per request. Param names...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: squid (UTSA-2026-152893)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-152893 advisory. Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggli...

CVE-2026-126073

A flaw was found in Action Pack. When determining response formats through content negotiation, Action Pack fails to properly set or append to the HTTP Vary response header under certain request conditions. A remote attacker can exploit this behavior by sending requests through a shared...

CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit (CENTOS7:CLSA-2026:1794009672)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2026:1794009672 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerabl...

CVE-2026-103866

A flaw was found in Apache Sling Engine. A remote attacker could perform HTTP request smuggling by sending specially crafted requests containing non-standard percent-encoded characters or invalid character sets. Because the query and form parser continues processing requests despite encountering...

CentOS Linux 8.4 [TuxCare] Security Update: squid (CENTOS8.4:CLSA-2026:1793933095)

The CentOS Linux 8.4 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS8.4:CLSA-2026:1793933095 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

CentOS Linux 8 [TuxCare] Security Update: squid (CENTOS-STREAM8:CLSA-2026:1793918953)

The CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the TuxCare CENTOS- STREAM8:CLSA-2026:1793918953 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

Ubuntu 26.04 LTS : Squid vulnerability (USN-8998-1)

The remote Ubuntu 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8998-1 advisory. It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request...

USN-8998-1 squid vulnerability

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches...

USN-8998-1: Squid vulnerability

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches...

CVE-2026-85254

A flaw was found in Apache Camel's Platform HTTP component. The mechanism designed to prevent request headers from being reflected into HTTP responses improperly compares header names using case-sensitive checks. A remote attacker can exploit this behavior by varying header name casing or sending...

CVE-2026-120633

A flaw was found in perl-CGI. This vulnerability allows a remote attacker to conduct web cache poisoning or redirect users to malicious websites by sending crafted Hypertext Transfer Protocol HTTP requests with untrusted host headers. Because the module trusts client-provided headers such as...

OESA-2026-4583 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4582 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4581 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

OESA-2026-4580 squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests. Security Fixes: Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper...

AlmaLinux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The AlmaLinux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...

Rocky Linux 9.6 [TuxCare] Security Update: squid (ALMALINUX9.6:CLSA-2026:1793281224)

The Rocky Linux 9.6 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1793281224 advisory. - Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is...