CVE-2026-33515mediumCWE-125CWE-1289

CVE-2026-33515: medium-severity vulnerability in squid-cache squid

Squid has issues in ICP message handling

Published

Follow this CVE+ Monitor squid+ Monitor squid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 1.1%
In short

Squid proxy can leak small amounts of memory when processing certain malformed ICP network messages, potentially exposing sensitive data. This only affects systems that have ICP support explicitly enabled.

Technical detail

Out-of-bounds read in Squid's ICP message handler (CWE-125, CWE-1289) caused by improper input validation. Remote attacker can trigger memory disclosure by sending crafted ICP requests to systems with non-zero icp_port configuration; impact is limited to small memory leaks but may contain sensitive information. icp_access rules do not mitigate this vulnerability.

Summary generated and translated by AI from the official description.
Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Affected products
squid-cache · squid
Related CVEs — squid-cache squid

In the same product, most dangerous first.

CVE-2023-49285HIGHDenial of Service in HTTP Message Processing in SquidEPSS 88.1%CVE-2024-25617MEDIUMDenial of Service in HTTP Header parser in squid proxyEPSS 88.1%CVE-2024-25111HIGHSQUID-2024:1 Denial of Service in HTTP Chunked DecodingEPSS 65.3%CVE-2025-62168CRITICALSquid vulnerable to information disclosure via authentication credential leakage in error handlingEPSS 64.8%CVE-2024-23638MEDIUMSQUID-2023:11 Denial of Service in Cache ManagerEPSS 60.1%CVE-2023-50269HIGHSQUID-2023:10 Denial of Service in HTTP Request parsingEPSS 57.6%