Junglewise Threat Intelligence

CVE-2026-33526: Squid heap use-after-free in ICP request handling

CVE-2026-33526 · Severity: high · CVSS 7.5 · Published 2026-03-26

Executive brief

Squid, a widely used web caching proxy, is vulnerable to a flaw that allows remote attackers to crash the service. This can lead to a total service outage, preventing users from accessing the internet or internal web resources. The issue specifically affects organizations that have the Internet Cache Protocol (ICP) enabled.

Technical details

A heap use-after-free vulnerability exists in Squid's handling of Internet Cache Protocol (ICP) traffic. The flaw is triggered when Squid processes malformed URIs within ICP queries; specifically, chained calls to the rfc1738_escape() function can invalidate memory pointers, leading to a crash. An unauthenticated remote attacker can exploit this by sending specially crafted ICP packets to a target Squid instance that has a non-zero 'icp_port' configured. Standard 'icp_access' rules do not mitigate the issue because the vulnerability occurs during the initial parsing of the request. The issue is resolved in Squid version 7.5.

Affected products

  • Squid-cache Squid 3.0 through 7.4

Timeline

  • 2025-09-07: other: Initial report of vulnerabilities
  • 2026-03-25: advisory: Vendor advisory published (SQUID-2026:1)
  • 2026-03-26: disclosed: CVE published to NVD
  • 2026-03-25: patched: Version 7.5 released with fix

References