Executive brief
Squid is a widely used web caching proxy that helps speed up internet access and reduce bandwidth usage. A security flaw has been identified where a malicious or compromised 'trusted peer' server can send specially crafted data that causes the Squid service to crash or behave unpredictably. This could lead to a service outage, affecting the ability of users to access the web through the proxy.
Technical details
A heap-based buffer overflow exists in Squid's 'peerDigestSwapInMask' function within 'src/peer_digest.cc'. The vulnerability is caused by improper input validation where a cache digest's on-the-wire size can exceed the 'mask_size' declared within the digest. An attacker controlling a trusted cache peer can exploit this by sending a maliciously crafted reply to a 'cache_digest' request. This attack requires the Squid instance to be compiled with '--enable-cache-digests' and configured with 'cache_peer' entries. The issue is resolved in version 7.6 by validating that the incoming data size does not exceed the allocated mask size.
Affected products
- Squid-cache Squid 3.x through 3.5.27, 4.x through 4.17, 5.x through 5.9, 6.x through 6.14, 7.x through 7.5
Timeline
- 2026-05-11: disclosed: Initial report to the Squid project
- 2026-05-30: patched: Patch published in source repository
- 2026-06-08: advisory: Squid version 7.6 released
- 2026-07-16: advisory: CVE-2026-50012 published to NVD