Junglewise Threat Intelligence

CVE-2026-32748: Squid heap use-after-free in ICP request handling

CVE-2026-32748 · Severity: high · CVSS 7.5 · Published 2026-03-26

Technologies: Red Hat Enterprise Linux AppStream. Vendors: Red Hat.

Executive brief

Squid, a widely used web caching proxy, is vulnerable to a flaw that allows remote attackers to crash the service. By sending specially crafted network traffic using the Internet Cache Protocol (ICP), an attacker can cause a service outage, disrupting internet access for users and applications relying on the proxy. This issue only affects systems where ICP support has been explicitly enabled.

Technical details

A heap use-after-free vulnerability exists in Squid's handling of Internet Cache Protocol (ICP) traffic, specifically within the ACLFilledChecklist component. The root cause is the premature release of the HttpRequest resource during its expected lifetime; the ACLChecklist destructor automatically unlocks the request object, leading to a use-after-free when Squid attempts to use the destroyed object upon the return of icpAccessAllowed(). This vulnerability is exploitable by a remote, unauthenticated attacker via the network if a non-zero 'icp_port' is configured. Notably, the flaw cannot be mitigated by 'icp_access' rules because the crash occurs during the processing of the query regardless of whether access is granted or denied. The issue is fixed in Squid version 7.5.

Affected products

  • Squid-Cache Squid 3.0 through 7.4
  • Red Hat Enterprise Linux Server (v. 7 ELS) 7
  • Red Hat Enterprise Linux AppStream (v. 8, 10) 8, 10.1

Timeline

  • 2026-02-08: disclosed: Vulnerability reported to vendor
  • 2026-02-18: patched: Official fixes committed to master branch
  • 2026-03-25: advisory: Vendor advisory SQUID-2026:2 published
  • 2026-03-26: disclosed: NVD publication date

References

Related threats