CVE-2026-32748
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).
Risk Assessment
A remote attacker can perform a reliable and repeatable Denial of Service attack against the Squid service, causing crashes. Denying ICP queries via `icp_access` rules does not mitigate the issue.
Recommendation
Upgrade Squid to version 7.5 or later immediately. If not possible, consider disabling ICP support by setting `icp_port 0` unless required.
Original NVD description (English source)
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.