by Kastro CVE-2026-33526
squid-cache squid — Squid vulnerable to Denial of Service in ICP Request handling
Description · from the CVE record
Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.
Affected
ProductAffectedFixed inSource
squid< 7.5–CNA
Red Hat Enterprise Linux 10see advisory7:6.10-6.el10_1.3redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Supportsee advisory7:6.10-5.el10_0.2redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Supportsee advisory7:3.5.20-17.el7_9.16redhat-SADP
Red Hat Enterprise Linux 8see advisory8100020260408092701.489197e6redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportsee advisory8040020260514123440.522a0ee4redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-Onsee advisory8040020260514123440.522a0ee4redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportsee advisory8060020260518090356.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.6 Telecommunications Update Servicesee advisory8060020260518090356.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionssee advisory8060020260518090356.ad008a3aredhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Servicesee advisory8080020260514105733.63b34585redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionssee advisory8080020260514105733.63b34585redhat-SADP
Scores by source
GitHub_M (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
redhat-SADP (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial