Squid's HTTP header parser incorrectly accepts a bare "Transfer-Encoding: identity" header, which the HTTP specification forbids because any transfer coding must be wrapped within chunked encoding. This flaw allows a client to craft a request smuggling payload that is forwarded to upstream servers or manipulated within Squid, enabling the attacker to inject arbitrary content into the HTTP cache or alter subsequent client requests. The injected content can be served to other users who later request the poisoned URL, effectively poisoning the cache.

The vulnerability exists in Squid caching proxy versions from 3.3.0.1 through 7.5.x. Any installation of Squid in that version range on any operating system is susceptible if it accepts HTTP/1.1 traffic.

The CVSS score of 7.7 indicates high severity, while the EPSS score of 2% reflects a moderate likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers must be able to send HTTP/1.1 traffic to the affected Squid instance—typically from a trusted client or a compromised system. Once the malformed header is accepted, the smuggling can bypass security controls located between the client and Squid, allowing cache poisoning.