This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Squid fixes 3 vulnerabilities, 1 of them critical
Squid fixes 3 vulnerabilities, 1 of them critical, in version 7.5 [1][2][3].
Allows an unauthenticated remote attacker to carry out a DoS attack due to a heap use-after-free vulnerability when processing ICP traffic [1].
The vulnerability is present in product:
- Squid; <7.5
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
More information:
- CVE-2026-33526 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Allows an unauthenticated remote attacker to carry out a DoS attack due to premature release of a resource during its expected lifetime and a heap use-after-free vulnerability when processing ICP traffic [2].
The vulnerability is present in product:
- Squid; <7.5
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
More information:
- CVE-2026-32748 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Allows an unauthenticated remote attacker, due to insufficient input validation when processing ICP traffic, to read data outside the bounds of allocated memory and thereby obtain a small amount of potentially sensitive information [3].
The vulnerability is present in product:
- Squid; <7.5
CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
More information:
- CVE-2026-33515 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
The vulnerability was publicly disclosed 25. 3. 2026.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 26. 3. 2026.