Is CVE-2026-32748 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-32748 being exploited in the wild.

How severe is CVE-2026-32748?

High severity, with a CVSS score of 7.5, published 26 March 2026.

Which products and versions are affected?

Red Hat Enterprise Linux AppStream 8, 10.1.

Is there a fix for CVE-2026-32748?

A patch was published on 2026-02-18: Official fixes committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-32748 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-32748?

Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-32748: Squid heap use-after-free in ICP request handling

CVE-2026-32748 · Severity: high · CVSS 7.5 · Published 2026-03-26

Squid, a widely used web caching proxy, is vulnerable to a flaw that allows remote attackers to crash the service. By sending specially crafted network traffic using the Internet Cache Protocol (ICP), an attacker can cause a service outage, disrupting internet access for users and applications relying on the proxy. This issue only affects systems where ICP support has been explicitly enabled.

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Quick answers

Is CVE-2026-32748 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-32748 being exploited in the wild.
How severe is CVE-2026-32748?: High severity, with a CVSS score of 7.5, published 26 March 2026.
Which products and versions are affected?: Red Hat Enterprise Linux AppStream 8, 10.1.
Is there a fix for CVE-2026-32748?: A patch was published on 2026-02-18: Official fixes committed to master branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-32748 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-32748?: Check whether you run Red Hat Enterprise Linux AppStream at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap use-after-free vulnerability exists in Squid's handling of Internet Cache Protocol (ICP) traffic, specifically within the ACLFilledChecklist component. The root cause is the premature release of the HttpRequest resource during its expected lifetime; the ACLChecklist destructor automatically unlocks the request object, leading to a use-after-free when Squid attempts to use the destroyed object upon the return of icpAccessAllowed(). This vulnerability is exploitable by a remote, unauthenticated attacker via the network if a non-zero 'icp_port' is configured. Notably, the flaw cannot be mitigated by 'icp_access' rules because the crash occurs during the processing of the query regardless of whether access is granted or denied. The issue is fixed in Squid version 7.5.

Affected products

Squid-Cache Squid 3.0 through 7.4
Red Hat Enterprise Linux Server (v. 7 ELS) 7
Red Hat Enterprise Linux AppStream (v. 8, 10) 8, 10.1

Timeline

2026-02-08: disclosed: Vulnerability reported to vendor
2026-02-18: patched: Official fixes committed to master branch
2026-03-25: advisory: Vendor advisory SQUID-2026:2 published
2026-03-26: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.