Denial of Service Vulnerability in Squid Caching Proxy Software
CVE-2026-33526

9.2CRITICAL

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33526?

The Squid caching proxy software is susceptible to a Denial of Service vulnerability due to a heap Use-After-Free condition when processing Internet Cache Protocol (ICP) traffic. This issue allows an attacker to disrupt the operation of the Squid service by sending crafted ICP requests, provided that ICP support is enabled in the configuration (i.e., setting a non-zero value for icp_port). Notably, this vulnerability cannot be mitigated through access control lists (icp_access), making it crucial for users to update to version 7.5, which contains the necessary fix.

Affected Version(s)

squid < 7.5

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_CONFIRM
https://github.com/squid-cache/squid/commit/8a7d42f9d44be...
x_refsource_MISC

EPSS Score

12% chance of being exploited in the next 30 days.

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.