Executive brief
Squid, a widely used web caching proxy, is vulnerable to a flaw that allows remote attackers to crash the service. This can lead to a total service outage, preventing users from accessing the internet or internal web resources. The issue specifically affects organizations that have the Internet Cache Protocol (ICP) enabled.
Technical details
A heap use-after-free vulnerability exists in Squid's handling of Internet Cache Protocol (ICP) traffic. The flaw is triggered when Squid processes malformed URIs within ICP queries; specifically, chained calls to the rfc1738_escape() function can invalidate memory pointers, leading to a crash. An unauthenticated remote attacker can exploit this by sending specially crafted ICP packets to a target Squid instance that has a non-zero 'icp_port' configured. Standard 'icp_access' rules do not mitigate the issue because the vulnerability occurs during the initial parsing of the request. The issue is resolved in Squid version 7.5.
Affected products
- Squid-cache Squid 3.0 through 7.4
Timeline
- 2025-09-07: other: Initial report of vulnerabilities
- 2026-03-25: advisory: Vendor advisory published (SQUID-2026:1)
- 2026-03-26: disclosed: CVE published to NVD
- 2026-03-25: patched: Version 7.5 released with fix
References
- https://github.com/squid-cache/squid/commit/8a7d42f9d44befb8fcbbb619505587c8de6a1e91
- https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg
- http://www.openwall.com/lists/oss-security/2026/03/25/2
- https://access.redhat.com/errata/RHSA-2026:10255
- https://access.redhat.com/errata/RHSA-2026:10256
- https://access.redhat.com/errata/RHSA-2026:10257
- https://access.redhat.com/errata/RHSA-2026:11901