CVE-2026-32748highCWE-413CWE-416CWE-826

CVE-2026-32748: high-severity vulnerability in squid-cache squid

Squid has Denial of Service in ICP Response handling

Published · Updated

Follow this CVE+ Monitor squid+ Monitor squid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 9.1%
In short

Squid proxy versions before 7.5 have memory bugs in ICP (Internet Cache Protocol) handling that allow attackers to crash the service. An attacker can reliably take the service offline by sending specially crafted ICP traffic.

Technical detail

The vulnerability stems from premature resource release and heap use-after-free conditions (CWE-413, CWE-416, CWE-826) in ICP response processing. A remote attacker can trigger a Denial of Service by sending ICP protocol packets to Squid instances with icp_port enabled; this requires explicit ICP configuration and cannot be mitigated by icp_access rules alone.

Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
Affected products
squid-cache · squid
Related CVEs — squid-cache squid

In the same product, most dangerous first.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.1%CVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.1%CVE-2024-25111HIGHSQUID-2024:1 Denial of Service in HTTP Chunked DecodingEPSS 65.3%CVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 64.8%CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2023-50269HIGHSQUID-2023:10 Denial of Service in HTTP Request parsingEPSS 57.6%