CVE-2026-33526
HighCVSS 7.5Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.
Risk Assessment
Organizations using a vulnerable Squid version with ICP enabled risk service disruption from a remote attacker, potentially leading to unavailability of network resources.
Recommendation
Immediately upgrade Squid to version 7.5 or later. If upgrading is not possible, disable ICP support by setting `icp_port 0` if acceptable for the environment.
Other vulnerabilities in Squid
See all- CVE-2016-4556High
A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
- CVE-2016-4554High
The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.
- CVE-2016-4553High
The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.
- CVE-2016-4054High
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-4052High
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-3948High
Squid versions 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, allowing remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.
- CVE-2016-2571High
In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
- CVE-2016-2569High
Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
- CVE-2026-32748High
Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).
- CVE-2023-46847High
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
Original NVD description (English source)
Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.