Denial of Service Vulnerability in Squid Caching Proxy by Squid Software
CVE-2026-32748

8.7HIGH

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
26 March 2026

What is CVE-2026-32748?

Squid, a widely used caching proxy server, has a security vulnerability that occurs due to improper handling of resources during their expected lifecycle and specific heap Use-After-Free errors. This issue primarily affects versions of Squid prior to 7.5 configured to support Internet Cache Protocol (ICP) traffic. An attacker can exploit this vulnerability to execute repeatable Denial of Service (DoS) attacks against the Squid service. Notably, the attacks target configurations where the icp_port is set to a non-zero value, and attempts to limit ICP queries through icp_access rules do not provide any mitigation. Users are strongly advised to upgrade to Squid version 7.5 or higher to resolve this issue.

Affected Version(s)

squid < 7.5

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_CONFIRM
https://github.com/squid-cache/squid/commit/703e07d25ca6f...
x_refsource_MISC

EPSS Score

9% chance of being exploited in the next 30 days.

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.