Squid has discovered an issue where it checks its cache for response availability by making an MD5 hash of the absolute URL. This can include decoded UserInfo, allowing attackers to provide a username with special characters and treat the rest of the URL as a path or query string. This could lead to access to features only reverse proxies can use.
