Skip to main content

Squid CVE-2026-33515

| EUVDEUVD-2026-16067 MEDIUM
Out-of-bounds Read (CWE-125)
2026-03-26 GitHub_M
Buffer Overflow Information Disclosure Squid Squid Cache
6.9
CVSS 4.0 · GitHub Advisory
View

Vulnerability Assessment

Weakness
CWE
CWE-125
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK

1 technique across 1 tactic: Collection

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Impact

While formal CVSS and EPSS scores are not available for this CVE, the risk assessment can be synthesized from available signals: The attack vector is network-based and requires no authentication, but exploitation is limited to Squid instances with ICP explicitly enabled (reducing overall exposure). The technical impact is information disclosure of potentially sensitive memory contents, which is significant but not catastrophic (no code execution, no denial of service, no direct system compromise). The vulnerability affects a production-grade caching proxy widely deployed in enterprise and ISP environments, particularly tracked across at least 7 Debian releases, indicating substantial user base exposure. A patch is available (version 7.5), and security advisories and pull request discussions exist on GitHub, suggesting coordinated disclosure. The lack of KEV or EPSS data and the requirement for explicit ICP configuration suggest this is a moderate-priority vulnerability suitable for standard patch management cycles rather than emergency response, though organizations with ICP-enabled Squid deployments should treat it as higher priority.
Exploit ScenarioDerived

An attacker identifies a Squid proxy with ICP enabled (via port scanning for UDP 3130 or configuration reconnaissance) and crafts a malformed ICP request with invalid parameters that bypass input validation checks. When the vulnerable Squid instance processes this crafted request and attempts to generate an error response, the out-of-bounds read occurs, allowing the attacker to extract small fragments of Squid process memory. By repeatedly sending variations of malformed requests, the attacker can exfiltrate memory contents that may contain cached credentials, session tokens, or other sensitive information previously processed by the proxy. The attack requires only network access to the ICP port and imposes minimal computational cost, making it a low-barrier exploitation scenario for systems with ICP enabled.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 1.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Squid prior to version 7.5 contains an out-of-bounds read vulnerability in ICP (Internet Cache Protocol) traffic handling due to improper input validation, classified as CWE-125. Remote attackers can exploit this to leak small amounts of process memory potentially containing sensitive information by sending malformed ICP requests to deployments with explicitly enabled ICP support (non-zero icp_port configuration). The vulnerability affects all versions of Squid before 7.5, and while no CVSS score or EPSS data is currently available, the information disclosure impact and remote attack vector indicate moderate to significant risk for affected deployments.

RemediationAI

The primary remediation is to upgrade Squid to version 7.5 or later, which contains the patch for the out-of-bounds read vulnerability. Refer to the official Squid security advisory at https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c for vendor-specific upgrade guidance and patch details. For deployments that cannot immediately upgrade, the most effective interim mitigation is to disable ICP support entirely by setting icp_port to 0 in the Squid configuration file, as the vulnerability is only exploitable when ICP is explicitly enabled. Note that standard icp_access ACL rules cannot prevent exploitation, so disabling the protocol is the only workaround. Organizations should prioritize patching systems with ICP enabled, as these are directly at risk, while systems with ICP disabled are not vulnerable.

Affected VersionsENISA

squid < 7.5

Affected Packages

euvd squid fix: 7.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in Squid's ICP protocol handler, which is a lightweight UDP-based protocol used for inter-cache communication in web caching hierarchies. ICP is an optional feature that must be explicitly enabled via the icp_port configuration parameter. The root cause is classified as CWE-125 (Out-of-bounds Read), indicating that Squid fails to properly validate the bounds of input data when processing ICP requests before performing memory reads. When an invalid or specially crafted ICP request is received, the validation bypass allows the application to read beyond allocated buffer boundaries, causing information disclosure. The affected product is identified via CPE cpe:2.3:a:squid-cache:squid with versions prior to 7.5, and notably, standard ACL-based mitigations (icp_access rules) cannot prevent this attack since the vulnerability exists in the parsing layer before access control evaluation.

Know when Squid gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Ubuntu MEDIUM
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 5.3 MEDIUM

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
Low
Vulnerable system: Integrity
Low
Vulnerable system: Availability
None
Subsequent system: Confidentiality
Low
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 26, 2026 - 00:13 nvd
MEDIUM 6.9

DescriptionGitHub Advisory

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Executive ViewAI

Why It Matters

Organizations using Squid should be aware of notable risk from CVE-2026-33515, a out-of-bounds read vulnerability rated CVSS 6.9. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.

Business Impact: Moderate
Compensating Controls

Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.

Threat Intelligence Overview

EPSS Score
1.0%
Top 24% exploitable
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 1.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Technical Impact
Partial

Priority Score

35
Low Medium High Critical
KEV: 0
EPSS: +1
CVSS: +34
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Related Vulnerabilities in Squid ICP Traffic Handling Vulnerabilities

View all 3
CVE-2026-32748 HIGH
8.7
CVE-2026-33526 CRITICAL
9.2

More in Squid

View all
CVE-2016-4553 HIGH
8.6 May 10

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI i
CVE-2023-46847 HIGH
7.5 Nov 03

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to

CVE-2016-4054 HIGH
8.1 Apr 25

Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via cr
CVE-2016-4555 HIGH POC
7.5 May 10

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of servi
CVE-2016-3947 HIGH
8.2 Apr 07

Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and
CVE-2013-4123 MEDIUM POC
5.0 Sep 16

client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of

CVE-2013-4115 HIGH
7.5 Aug 09

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows

CVE-2016-4554 HIGH
8.6 May 10

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly c
CVE-2014-7141 MEDIUM
6.4 Nov 26

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic
CVE-2014-3609 MEDIUM
5.0 Sep 11

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (
CVE-2016-2569 HIGH
7.5 Feb 27

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote server
CVE-2016-3948 HIGH
7.5 Apr 07

Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

Ubuntu

Priority: Medium
squid
Release Status Version
focal needs-triage -
jammy needs-triage -
noble needs-triage -
questing needs-triage -
upstream needs-triage -
squid3
Release Status Version
xenial needs-triage -
bionic needs-triage -
jammy DNE -
noble DNE -
questing DNE -
upstream needs-triage -

Debian

squid
Release Status Fixed Version Urgency
bullseye vulnerable 4.13-10+deb11u3 -
bullseye (security) vulnerable 4.13-10+deb11u6 -
bookworm vulnerable 5.7-2+deb12u5 -
bookworm (security) vulnerable 5.7-2+deb12u4 -
trixie, trixie (security) vulnerable 6.13-2+deb13u1 -
forky vulnerable 7.4-1 -
sid fixed 7.5-1 -
(unstable) fixed 7.5-1 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8941-1 ADVISORY https://vuldb.com/vuln/353116 REF http://www.openwall.com/lists/oss-security/2026/03/25/4 REF https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165 REF https://github.com/squid-cache/squid/pull/2220 REF https://github.com/squid-cache/squid/pull/2220#discussion_r2727683637 REF https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy