Squid versions from 3.3.0.1 up to but not including 7.6 are vulnerable to an HTTP Request Smuggling attack due to improper enforcement of HTTP/1.1 Transfer-Encoding header parsing. This flaw allows a trusted client to bypass security mechanisms and potentially poison upstream HTTP caches with malicious content. The vulnerability is fixed in Squid version 7.6.