Log in Start free

Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-50012Squid: Memory corruption in cache_digest reply handling

Medium 5.5

In plain English

A medium-severity improper input validation in squid from squid-cache. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)1.4%top 28.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23squid7.6-r0ALPINE-CVE-2026-50012
Alpine:v3.24squid7.6-r0ALPINE-CVE-2026-50012
Debian:12squid5.7-2+deb12u6DEBIAN-CVE-2026-50012
Debian:13squid6.13-2+deb13u2DEBIAN-CVE-2026-50012
Debian:14squid7.6-1DEBIAN-CVE-2026-50012
Ubuntu:22.04:LTSsquid5.9-0ubuntu0.22.04.8USN-8941-1
Ubuntu:22.04:LTSsquid5.9-0ubuntu0.22.04.7UBUNTU-CVE-2026-50012
Ubuntu:24.04:LTSsquid6.14-0ubuntu0.24.04.4UBUNTU-CVE-2026-50012
Ubuntu:24.04:LTSsquid6.14-0ubuntu0.24.04.5USN-8941-1
Ubuntu:25.10squid6.14-0ubuntu0.25.10.4UBUNTU-CVE-2026-50012
Ubuntu:26.04:LTSsquid7.2-2ubuntu2.2UBUNTU-CVE-2026-50012

Affected products (as reported)

VendorProductVersions
squid-cache squid < 7.6

Weakness: CWE-20, CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H

References