Out of Bounds Read in Squid Caching Proxy Affects Web Traffic Handling

CVE-2026-33515

What is CVE-2026-33515?

Squid, the widely used caching proxy, is susceptible to an input validation flaw that can lead to an out of bounds read when handling Internet Cache Protocol (ICP) traffic. This vulnerability primarily affects installations where ICP support is enabled, allowing a remote attacker to exploit the flaw and potentially extract small amounts of sensitive memory data in error responses to invalid ICP requests. Deployments without careful management of ICP settings may be particularly at risk, underlining the need for immediate updates to version 7.5 or later, which includes a patch addressing this critical flaw.

References