CVE-2026-50012
MediumCVSS 5.5Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
Squid versions prior to 7.6 contain a heap-based buffer overflow vulnerability in cache digest reply handling. The flaw is due to improper input validation of the on-the-wire size of a cache digest, which may exceed the declared mask_size.
Risk Assessment
A trusted peer can send a maliciously crafted cache digest reply, triggering a heap buffer overflow that may cause a crash or potentially arbitrary code execution. This vulnerability only affects Squid instances compiled with --enable-cache-digests and configured with cache_peer entries.
Recommendation
Upgrade Squid to version 7.6 or later immediately. If upgrading is not possible, consider disabling the --enable-cache-digests option or restricting trusted peers.
Other vulnerabilities in Squid
See all- CVE-2016-4556High
A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
- CVE-2016-4554High
The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.
- CVE-2016-4553High
The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.
- CVE-2016-4054High
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-4052High
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-3948High
Squid versions 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, allowing remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.
- CVE-2016-2571High
In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
- CVE-2016-2569High
Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
- CVE-2026-33526High
Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.
- CVE-2026-32748High
Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).
Original NVD description (English source)
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.