Log in Start free

Vulnerability · Published Mar 26, 2026 · Assigned by GitHub_M

CVE-2026-33515Squid has issues in ICP message handling

Medium 6.9

In plain English

A medium-severity out-of-bounds read in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium
Exploit odds (30 days)1.1%top 35.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12squid5.7-2+deb12u6DEBIAN-CVE-2026-33515
Debian:13squid6.13-2+deb13u2DEBIAN-CVE-2026-33515
Debian:14squid7.5-1DEBIAN-CVE-2026-33515
Ubuntu:22.04:LTSsquid5.9-0ubuntu0.22.04.8USN-8941-1
Ubuntu:22.04:LTSsquid5.9-0ubuntu0.22.04.5UBUNTU-CVE-2026-33515
Ubuntu:24.04:LTSsquid6.14-0ubuntu0.24.04.2UBUNTU-CVE-2026-33515
Ubuntu:24.04:LTSsquid6.14-0ubuntu0.24.04.5USN-8941-1
Ubuntu:25.10squid6.14-0ubuntu0.25.10.2UBUNTU-CVE-2026-33515

Affected products (as reported)

VendorProductVersions
squid-cache squid < 7.5

Weakness: CWE-125, CWE-1289 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

References