Skip to main content

Squid CVE-2026-32748

| EUVDEUVD-2026-16056 HIGH
Improper Resource Locking (CWE-413)
2026-03-26 GitHub_M
Denial Of Service Squid Squid Cache
8.7
CVSS 4.0 · Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted ICP protocol packets
  2. Delivery
    Trigger premature resource release
  3. Exploit
    Cause heap Use-After-Free condition
  4. Execution
    Crash Squid service
  5. Impact
    Achieve Denial of Service

Vulnerability Assessment

Weakness
CWE
CWE-413
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
Exploitation Conditions

Squid versions prior to 7.5 with ICP support explicitly enabled (non-zero icp_port configuration). Remote unauthenticated attacker sends crafted ICP protocol packets. Default Squid installations without ICP enabled are NOT affected.
Impact

Despite the absence of CVSS and EPSS scores, this vulnerability presents moderate-to-high real-world risk based on available signals: (1) the attack vector is network-based with likely low complexity, requiring only crafted ICP packets over UDP; (2) no special privileges or user interaction are required; (3) a confirmed patch is available (commit 703e07d25ca6fa11f52d20bf0bb879e22ab7481b in version 7.5), indicating the vendor has validated and fixed the issue; (4) the vulnerability is confined to deployments with explicitly enabled ICP (non-zero icp_port), reducing the baseline attack surface compared to default installations; (5) the technical impact is denial of service (service unavailability), which is significant for availability-critical proxy infrastructure. However, unlike network-wide exploits, this requires ICP to be explicitly enabled-suggesting it is not a default configuration risk. The absence of public POC and KEV designation suggests it has not yet entered widespread exploitation, but the simplicity of ICP protocol and confirmed memory corruption make it a priority for affected operators.
Exploit ScenarioDerived

An attacker on the network (or with network path visibility to the Squid instance) sends a sequence of malformed or specially crafted ICP query packets to the target Squid proxy's ICP port. These packets trigger the use-after-free condition in the ICP handler, causing heap corruption and immediate process termination. The attacker can repeat this attack reliably to maintain a persistent denial of service state, preventing legitimate cache queries and web traffic from being proxied until the service is manually restarted-or until the operator disables ICP or upgrades to version 7.5.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 1.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Squid proxy versions prior to 7.5 contain use-after-free and premature resource release vulnerabilities in ICP (Internet Cache Protocol) traffic handling that enable reliable, repeatable denial of service attacks. Remote attackers can exploit these memory safety bugs to crash the Squid service by sending specially crafted ICP packets, affecting deployments that have explicitly enabled ICP support via non-zero icp_port configuration. While no CVSS score or EPSS value is currently published, the vulnerability is confirmed by vendor advisory and includes a public patch commit, indicating moderate to high real-world risk for affected deployments.

RemediationAI

Upgrade Squid to version 7.5 or later immediately. For organizations unable to patch promptly, disable ICP support by setting icp_port to 0 in squid.conf and restarting the service-this eliminates the attack surface entirely and is guaranteed effective since the vulnerability cannot be mitigated by icp_access rules alone. Apply the patch from the vendor advisory (https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq) or pull the fixed code commit (703e07d25ca6fa11f52d20bf0bb879e22ab7481b) if building from source. For defense-in-depth, restrict UDP port 3130 (default ICP port) at the network perimeter to trusted peer caches only, and monitor Squid process stability for unexpected crashes or restarts.

Affected VersionsENISA

squid < 7.5

Affected Packages

euvd squid fix: 7.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Squid's ICP protocol implementation, which is a lightweight UDP-based protocol used for inter-cache communication and query distribution across cache hierarchies. The root cause is classified as CWE-413 (Improper Resource Validation), manifesting as both use-after-free (a heap memory corruption defect) and premature release of resources during their expected operational lifetime. These memory safety defects occur during ICP packet processing, suggesting flaws in object lifecycle management, reference counting, or buffer handling within Squid's ICP module. The affected software is identified via CPE (cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*), indicating all versions of Squid prior to 7.5 are vulnerable when ICP support is enabled.

Know when Squid gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (GitHub_M) PRIMARY 8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Ubuntu MEDIUM
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
Low

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 26, 2026 - 00:11 nvd
HIGH 8.7

DescriptionCVE.org

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem _cannot_ be mitigated by denying ICP queries using icp_access rules. This bug is fixed in Squid version 7.5.

Executive ViewAI

Why It Matters

Organizations using Squid face significant risk from CVE-2026-32748 rated CVSS 8.7. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. Organizations should apply vendor updates when available and consider compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.

Threat Intelligence Overview

EPSS Score
1.8%
Top 17% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 1.8%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

46
Low Medium High Critical
KEV: 0
EPSS: +2
CVSS: +44
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in Squid ICP Traffic Handling Vulnerabilities

View all 3
CVE-2026-33526 CRITICAL
9.2
CVE-2026-33515 MEDIUM
6.9

More in Squid

View all
CVE-2016-4553 HIGH
8.6 May 10

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI i
CVE-2023-46847 HIGH
7.5 Nov 03

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to

CVE-2016-4054 HIGH
8.1 Apr 25

Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via cr
CVE-2016-4555 HIGH POC
7.5 May 10

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of servi
CVE-2016-3947 HIGH
8.2 Apr 07

Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and
CVE-2013-4123 MEDIUM POC
5.0 Sep 16

client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of

CVE-2013-4115 HIGH
7.5 Aug 09

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows

CVE-2016-4554 HIGH
8.6 May 10

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly c
CVE-2014-7141 MEDIUM
6.4 Nov 26

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic
CVE-2014-3609 MEDIUM
5.0 Sep 11

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (
CVE-2016-2569 HIGH
7.5 Feb 27

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote server
CVE-2016-3948 HIGH
7.5 Apr 07

Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause

Same weakness CWE-413 – Improper Resource Locking

View all
CVE-2026-102083 HIGH
8.2
CVE-2019-8998 HIGH
7.8
CVE-2022-49737 HIGH
7.7
CVE-2023-28649 HIGH
7.5
CVE-2022-20678 HIGH
7.5
CVE-2025-0003 HIGH
7.3
CVE-2026-105390 MEDIUM
6.9
CVE-2026-92615 MEDIUM
6.6

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
squid
Release Status Version
focal needs-triage -
jammy needs-triage -
noble needs-triage -
questing needs-triage -
upstream needs-triage -
squid3
Release Status Version
xenial needs-triage -
bionic needs-triage -
jammy DNE -
noble DNE -
questing DNE -
upstream needs-triage -

Debian

squid
Release Status Fixed Version Urgency
bullseye vulnerable 4.13-10+deb11u3 -
bullseye (security) vulnerable 4.13-10+deb11u6 -
bookworm vulnerable 5.7-2+deb12u5 -
bookworm (security) vulnerable 5.7-2+deb12u4 -
trixie, trixie (security) vulnerable 6.13-2+deb13u1 -
forky vulnerable 7.4-1 -
sid fixed 7.5-1 -
(unstable) fixed 7.5-1 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/353115 REF http://www.openwall.com/lists/oss-security/2026/03/25/3 REF https://access.redhat.com/errata/RHSA-2026:10255 REF https://access.redhat.com/errata/RHSA-2026:10256 REF https://access.redhat.com/errata/RHSA-2026:10257 REF https://access.redhat.com/errata/RHSA-2026:11901 REF https://access.redhat.com/errata/RHSA-2026:20564 REF https://access.redhat.com/errata/RHSA-2026:20565 REF https://access.redhat.com/errata/RHSA-2026:20580 REF https://access.redhat.com/errata/RHSA-2026:6301 REF https://access.redhat.com/errata/RHSA-2026:8119 REF https://access.redhat.com/errata/RHSA-2026:8317 REF https://access.redhat.com/errata/RHSA-2026:8880 REF https://access.redhat.com/errata/RHSA-2026:9220 REF https://access.redhat.com/security/cve/CVE-2026-32748 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451577 REF https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab7481b REF https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32748.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy