Skip to main content

Squid CVE-2026-33526

| EUVDEUVD-2026-16068 CRITICAL
Use After Free (CWE-416)
2026-03-26 GitHub_M
Denial Of Service Use After Free Memory Corruption Squid Squid Cache
Critical
Disputed · 9.2 Vendor: GitHub_M
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send crafted ICP packet
  2. Exploit
    Trigger heap use-after-free in parser
  3. Execution
    Crash Squid process
  4. Impact
    Deny service

Vulnerability Assessment

Weakness
CWE
CWE-416
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Squid versions before 7.5 with ICP support explicitly enabled (non-zero icp_port configured). Remote unauthenticated attacker sends crafted ICP protocol packets to trigger heap use-after-free, causing denial of service. No victim interaction required.
Impact

Despite the absence of a published CVSS score and vector, this vulnerability carries significant real-world risk due to multiple compounding factors: the attack vector is network-based and unauthenticated (CVSS:AV:N), attack complexity is low since reliable exploitation is explicitly stated in the advisory, and the technical impact is complete denial of service of a critical infrastructure component (proxies are often mission-critical in enterprise networks). The vulnerability is not listed as actively exploited in known vulnerability databases (no KEV status noted), but the availability of the upstream patch commit (8a7d42f9d44befb8fcbbb619505587c8de6a1e91 on GitHub) indicates proof-of-concept development is feasible. The critical mitigation gap-that icp_access rules cannot prevent exploitation-elevates priority significantly. Organizations running Squid with ICP enabled face direct exploitability from any network position that can reach the ICP port. The distributed nature of Squid deployments in ISPs, CDNs, and enterprises amplifies the real-world impact.
Exploit ScenarioDerived

An attacker with network access to a Squid instance's ICP port (typically UDP 3130) crafts a malformed or specially-sequenced ICP query packet that triggers the use-after-free condition in the message parser. Upon receipt, the vulnerable Squid process dereferences freed memory, causing a segmentation fault or heap corruption that crashes the daemon, resulting in immediate service unavailability. Since ICP is often enabled on externally-facing proxy interfaces and the attack requires only unauthenticated network packets, an attacker can launch this denial of service from any network segment with IP-level reach to the icp_port, making it suitable for large-scale attacks against proxy infrastructure.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 2.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 26, 2026

Squid versions prior to 7.5 contain a heap use-after-free vulnerability (CWE-416) in ICP (Internet Cache Protocol) traffic handling that enables remote attackers to reliably trigger denial of service against affected proxy services. The vulnerability affects any Squid deployment with ICP support explicitly enabled via non-zero icp_port configuration, and cannot be mitigated through access control rules alone. A patch is available in version 7.5, and the vulnerability has been confirmed across multiple Debian releases and SUSE distributions.

RemediationAI

Upgrade Squid to version 7.5 or later, which includes the upstream patch (commit 8a7d42f9d44befb8fcbbb619505587c8de6a1e91). For systems unable to patch immediately, the only reliable mitigation is to disable ICP support by setting icp_port to 0 in squid.conf and restarting the service, though this may impact cache peering if ICP is in use. Organizations should prioritize patching since access control rules (icp_access) do not mitigate this memory corruption vulnerability. Consult your Linux distribution (Debian, SUSE, etc.) for backported packages, and verify patch application via version checking (squid -v) and testing ICP functionality is restored or disabled as intended.

Affected VersionsENISA

squid < 7.5

Affected Packages

euvd squid fix: 7.5

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability resides in Squid's ICP protocol implementation, a lightweight UDP-based cache discovery and querying protocol commonly used in distributed caching architectures. The root cause is a heap use-after-free condition (CWE-416) triggered during ICP packet processing, where memory is referenced after being freed, leading to memory corruption. The affected component is the ICP message handler in Squid's network stack, which processes incoming ICP queries on the configured icp_port. The CPE string cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:* indicates all Squid versions across all release branches are potentially affected up to the patched 7.5 version. This memory safety issue occurs at the protocol parsing level, making it exploitable remotely without authentication.

Know when Squid gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Medium–Critical)
Vendor (GitHub_M) PRIMARY 9.2 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Ubuntu MEDIUM
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 7.5 HIGH

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
None
Vulnerable system: Integrity
None
Vulnerable system: Availability
High
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
High

Lifecycle Timeline

2
Patch released
Mar 31, 2026 - 21:13 nvd
Patch available
CVE Published
Mar 26, 2026 - 00:16 nvd
CRITICAL 9.2

DescriptionCVE.org

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem _cannot_ be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Executive ViewAI

Why It Matters

Organizations using Squid face critical risk from CVE-2026-33526, a use-after-free vulnerability rated CVSS 9.2. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems. Organizations should apply vendor updates immediately when available and implement compensating controls in the interim.

Business Impact: Severe
Compensating Controls

Apply vendor patch. If immediate patching is not feasible: (1) Enable ASLR and DEP where available; (2) Implement network segmentation; (3) Monitor for exploitation indicators.

Threat Intelligence Overview

EPSS Score
2.0%
Top 17% exploitable
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 2.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Partial

Priority Score

48
Low Medium High Critical
KEV: 0
EPSS: +2
CVSS: +46
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

Related Vulnerabilities in Squid ICP Traffic Handling Vulnerabilities

View all 3
CVE-2026-32748 HIGH
8.7
CVE-2026-33515 MEDIUM
6.9

More in Squid

View all
CVE-2016-4553 HIGH
8.6 May 10

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI i
CVE-2023-46847 HIGH
7.5 Nov 03

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to

CVE-2016-4054 HIGH
8.1 Apr 25

Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via cr
CVE-2016-4555 HIGH POC
7.5 May 10

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of servi
CVE-2016-3947 HIGH
8.2 Apr 07

Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and
CVE-2013-4123 MEDIUM POC
5.0 Sep 16

client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of

CVE-2013-4115 HIGH
7.5 Aug 09

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows

CVE-2016-4554 HIGH
8.6 May 10

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly c
CVE-2014-7141 MEDIUM
6.4 Nov 26

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic
CVE-2014-3609 MEDIUM
5.0 Sep 11

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (
CVE-2016-2569 HIGH
7.5 Feb 27

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote server
CVE-2016-3948 HIGH
7.5 Apr 07

Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

Ubuntu

Priority: Medium
squid
Release Status Version
focal needs-triage -
jammy needs-triage -
noble needs-triage -
questing needs-triage -
upstream needs-triage -
squid3
Release Status Version
xenial needs-triage -
bionic needs-triage -
jammy DNE -
noble DNE -
questing DNE -
upstream needs-triage -

Debian

squid
Release Status Fixed Version Urgency
bullseye vulnerable 4.13-10+deb11u3 -
bullseye (security) vulnerable 4.13-10+deb11u6 -
bookworm vulnerable 5.7-2+deb12u5 -
bookworm (security) vulnerable 5.7-2+deb12u4 -
trixie, trixie (security) vulnerable 6.13-2+deb13u1 -
forky vulnerable 7.4-1 -
sid fixed 7.5-1 -
(unstable) fixed 7.5-1 -

SUSE

Severity: High
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed
SUSE Linux Enterprise Server 16.1 Fixed

References

Advisories & patches
ADVISORY https://vuldb.com/vuln/353114 REF http://www.openwall.com/lists/oss-security/2026/03/25/2 REF https://access.redhat.com/errata/RHSA-2026:10255 REF https://access.redhat.com/errata/RHSA-2026:10256 REF https://access.redhat.com/errata/RHSA-2026:10257 REF https://access.redhat.com/errata/RHSA-2026:11901 REF https://access.redhat.com/errata/RHSA-2026:20564 REF https://access.redhat.com/errata/RHSA-2026:20565 REF https://access.redhat.com/errata/RHSA-2026:20580 REF https://access.redhat.com/errata/RHSA-2026:6301 REF https://access.redhat.com/errata/RHSA-2026:8119 REF https://access.redhat.com/errata/RHSA-2026:8317 REF https://access.redhat.com/errata/RHSA-2026:8880 REF https://access.redhat.com/errata/RHSA-2026:9220 REF https://access.redhat.com/security/cve/CVE-2026-33526 REF https://bugzilla.redhat.com/show_bug.cgi?id=2451574 REF https://github.com/squid-cache/squid/commit/8a7d42f9d44befb8fcbbb619505587c8de6a1e91 REF https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33526.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy