Skip to main content

Squid CVE-2026-50012

| EUVDEUVD-2026-44961 MEDIUM
Improper Input Validation (CWE-20)
2026-06-12
Information Disclosure Squid Squid Cache
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unknown vector
  2. Exploit
    Unknown Squid component exploitation
  3. Impact
    Unknown impact

Vulnerability Assessment

Weakness
CWE
CWE-20
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
Exploitation Conditions

Exploitation conditions are entirely unknown - no description, CVSS vector, CWE, or technical advisory has been published for CVE-2026-50012 at time of analysis. It is not possible to determine whether exploitation is remote or local, authenticated or unauthenticated, requires specific configuration, or targets a default installation. No confirmed limiting factors can be stated. Defenders should treat this as an open question requiring follow-up against the oss-security thread and Squid maintainer advisories before assessing exposure.
Impact

Risk cannot be meaningfully quantified at this time. No CVSS base score or vector has been published, so attack vector, complexity, privilege requirements, user interaction, scope, and impact confidentiality/integrity/availability ratings are all unknown. EPSS probability is absent. KEV status is not listed, meaning CISA has not confirmed active exploitation. No POC is referenced. The only risk signal is that Squid is a high-value network infrastructure target with a history of critical remotely exploitable CVEs (e.g., buffer overflows, cache poisoning, denial-of-service chains). However, that historical context cannot be mapped to this specific CVE. MISSING: CVSS vector, affected version range, CWE, patch status, EPSS, and any technical detail. Risk rating must be deferred until NVD publication or vendor advisory is available.
Exploit ScenarioDerived

An exploit scenario cannot be responsibly constructed from available data. No attack vector, vulnerability class, or affected component has been disclosed. Constructing a scenario would require inventing technical detail not present in the intelligence, which would be misleading to defenders making real prioritization decisions. Revisit once the oss-security thread or NVD entry is published.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 2.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 12, 2026

Squid caching proxy is affected by CVE-2026-50012, disclosed via the oss-security mailing list on 2026-06-12 as a pre-NVD advisory. No technical details - description, affected versions, vulnerability class, or impact - have been made available in the current intelligence snapshot. The advisory was bundled with a sibling disclosure (CVE-2026-47729) from the same Squid maintainer post, suggesting a coordinated release, but no further differentiation between the two CVEs is derivable from available data. No exploitation, no KEV listing, and no EPSS score are present at time of analysis.

RemediationAI

No patch version, vendor advisory URL, or workaround has been identified in the available intelligence. Affected version range is unknown, making targeted upgrade guidance impossible. Until the oss-security thread or NVD entry provides version and fix details, organizations running Squid should monitor the official Squid advisories (https://www.squid-cache.org/Advisories/) and the oss-security list. As a general precautionary measure - not a confirmed mitigation for this specific CVE - operators may consider restricting external access to the Squid management interface and ensuring Squid is not exposed to untrusted networks without access controls. These are generic hardening steps with no confirmed trade-off for this CVE; apply only as interim posture while awaiting full disclosure.

Affected VersionsENISA

squid < 7.6

Affected Packages

euvd squid fix: 7.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Squid is a widely deployed open-source caching proxy supporting HTTP, HTTPS, FTP, and other protocols, commonly used in enterprise and ISP environments for traffic caching, filtering, and access control. No CWE identifier has been assigned, and no CPE string has been published, making it impossible to identify the specific component, subsystem, or protocol handler affected. The root cause class, attack surface, and technical mechanism are entirely unknown at this stage of disclosure. The oss-security post attributes the advisory to Amos Jeffries (squid3@...), a known Squid maintainer, which lends authenticity to the disclosure but provides no additional technical context.

Know when Squid gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
SUSE 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat 5.5 MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High

Lifecycle Timeline

2
Patch available
Jul 16, 2026 - 18:18 EUVD
CVSS changed
Jul 16, 2026 - 17:22 NVD
5.5 (MEDIUM)

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Executive ViewAI

Why It Matters

Squid caching proxy received a HIGH-severity vulnerability disclosure (CVE-2026-50012) on June 12, 2026, with no vendor patch identified at time of analysis. Critical technical details-including affected versions and exploitability factors-remain unavailable, creating significant uncertainty for organizations relying on Squid for caching and proxy functions. Immediate assessment and contingency planning are essential as additional details emerge over the coming days.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations pending technical details: implement network segmentation to isolate Squid infrastructure; restrict administrative access through principle of least privilege; enable enhanced logging and real-time alerting for anomalous proxy activity; maintain offline backup configurations to enable rapid recovery. Prioritize applying vendor patch immediately upon release.

Threat Intelligence Overview

EPSS Score
2.3%
Top 19% exploitable
Social Media
1
Sightings
Data Quality
7 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 2.3%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

30
Low Medium High Critical
KEV: 0
EPSS: +2
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Squid

View all
CVE-2016-4553 HIGH
8.6 May 10

client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI i
CVE-2023-46847 HIGH
7.5 Nov 03

Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to

CVE-2016-4054 HIGH
8.1 Apr 25

Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via cr
CVE-2016-4555 HIGH POC
7.5 May 10

client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of servi
CVE-2016-3947 HIGH
8.2 Apr 07

Heap-based buffer overflow in the Icmp6::Recv function in icmp/Icmp6.cc in the pinger utility in Squid before 3.5.16 and
CVE-2013-4123 MEDIUM POC
5.0 Sep 16

client_side_request.cc in Squid 3.2.x before 3.2.13 and 3.3.x before 3.3.8 allows remote attackers to cause a denial of

CVE-2013-4115 HIGH
7.5 Aug 09

Buffer overflow in the idnsALookup function in dns_internal.cc in Squid 3.2 through 3.2.11 and 3.3 through 3.3.6 allows

CVE-2016-4554 HIGH
8.6 May 10

mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly c
CVE-2014-7141 MEDIUM
6.4 Nov 26

The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of servic
CVE-2014-3609 MEDIUM
5.0 Sep 11

HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (
CVE-2016-2569 HIGH
7.5 Feb 27

Squid 3.x before 3.5.15 and 4.x before 4.0.7 does not properly append data to String objects, which allows remote server
CVE-2016-3948 HIGH
7.5 Apr 07

Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, which allows remote attackers to cause

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Server Applications 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Server 16.0 Affected
SUSE Linux Enterprise Server 16.1 Affected

References

Advisories & patches
ADVISORY https://seclists.org/oss-sec/2026/q2/896 ADVISORY https://ubuntu.com/security/notices/USN-8941-1 ADVISORY https://vuldb.com/vuln/370670 ADVISORY https://www.openwall.com/lists/oss-security/2026/06/12 REF https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd REF https://github.com/squid-cache/squid/pull/2423 REF https://github.com/squid-cache/squid/releases/tag/SQUID_7_6 REF https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy