Skip to content
OpenAdvisories
High · 8.7 CVE-2026-32748 EUVD-2026-16056

Squid has Denial of Service in ICP Response handling

Published Mar 26, 2026 · Updated Jul 15, 2026 · Assigned by GitHub_M

Vendor: squid-cache Product: squid Package: squid Package: squid Package: squid Package: squid3 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

Affected products

VendorProductAffectedFixed
squid-cache squid < 7.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 squid 7.5-1 —
Debian 13 squid 6.13-2+deb13u3 —
Debian 12 squid No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 squid 6.14-0ubuntu0.25.10.2 —
Ubuntu 24.04 LTS squid 6.14-0ubuntu0.24.04.2 USN-8941-1
Ubuntu 22.04 LTS squid 5.9-0ubuntu0.22.04.5 USN-8941-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS squid 4.10-1ubuntu1.13+esm3 USN-8941-1
Ubuntu Pro 18.04 LTS squid3 3.5.27-1ubuntu1.14+esm6 USN-8941-1
Ubuntu Pro 16.04 LTS squid3 3.5.12-1ubuntu7.16+esm7 USN-8941-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 squid 7:6.10-6.el10_1.3 RHSA-2026:8119
RHEL 9 squid 7:5.5-22.el9_7.4 RHSA-2026:6301
RHEL 8 libecap +1 1.0.1-2.module+el8.9.0+19703+a1da7223 RHSA-2026:8317
RHEL 8 squid 7:4.15-10.module+el8.10.0+24189+04a20c8a.11 RHSA-2026:8317
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS squid 7:6.10-5.el10_0.2 RHSA-2026:11901
RHEL 9.6 EUS squid 7:5.5-19.el9_6.3 RHSA-2026:9220
RHEL 9.4 EUS squid 7:5.5-13.el9_4.5 RHSA-2026:10255
RHEL 9.2 E4S squid 7:5.5-5.el9_2.11 RHSA-2026:10257
RHEL 9.0 E4S squid 7:5.2-1.el9_0.10 RHSA-2026:10256
RHEL 8.8 TUS libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20580
RHEL 8.8 TUS squid 7:4.15-6.module+el8.8.0+24284+6402ee68.10 RHSA-2026:20580
RHEL 8.8 E4S libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20580
RHEL 8.8 E4S squid 7:4.15-6.module+el8.8.0+24284+6402ee68.10 RHSA-2026:20580
RHEL 8.6 TUS libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20565
RHEL 8.6 TUS squid 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9 RHSA-2026:20565
RHEL 8.6 E4S libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20565
RHEL 8.6 E4S squid 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9 RHSA-2026:20565
RHEL 8.6 AUS libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20565
RHEL 8.6 AUS squid 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9 RHSA-2026:20565
RHEL 8.4 EUS Long Life libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20564
RHEL 8.4 EUS Long Life squid 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11 RHSA-2026:20564
RHEL 8.4 AUS libecap +1 1.0.1-2.module+el8.1.0+4044+36416a77 RHSA-2026:20564
RHEL 8.4 AUS squid 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11 RHSA-2026:20564
RHEL 7 ELS squid 7:3.5.20-17.el7_9.16 RHSA-2026:8880

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 squid 7:6.10-6.el10_1.3 ALSA-2026:8119
AlmaLinux 9 squid 7:5.5-22.el9_7.4 ALSA-2026:6301
AlmaLinux 8 libecap +1 1.0.1-2.module_el8.6.0+2741+01592ae8 ALSA-2026:8317
AlmaLinux 8 squid 7:4.15-10.module_el8.10.0+4163+e77fcdac.11 ALSA-2026:8317

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 squid 7:6.10-6.el10_1.3 RLSA-2026:8119
Rocky Linux 9 squid 7:5.5-22.el9_7.4 RLSA-2026:6301
Rocky Linux 8 libecap 1.0.1-2.module+el8.9.0+1437+df5ea8f0 RLSA-2026:8317
Rocky Linux 8 squid 7:4.15-10.module+el8.10.0+1758+80ba9f4b RLSA-2026:8317

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES 15 SP6 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 squid 6.14-160000.1.1 SUSE-SU-2026:24224-1
SLES for SAP 15 SP6 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES for SAP 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES for SAP 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES 16.0 squid 6.14-160000.1.1 SUSE-SU-2026:24224-1
SLE HPC 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLE HPC 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 16.0 squid 6.14-160000.1.1 openSUSE-SU-2026:22080-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 squid 7:6.13-1.amzn2023.0.4 ALAS2023-2026-1569
Amazon Linux 2 squid +2 7:3.5.20-17.amzn2.7.26 ALAS2-2026-3242

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 squid 6.13-4 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 squid 7:6.10-6.el10_1.3 ELSA-2026-8119
Oracle Linux 9 squid 7:5.5-22.el9_7.4 ELSA-2026-6301
Oracle Linux 8 libecap +1 1.0.1-2.module+el8.9.0+90083+f7556140 ELSA-2026-8317
Oracle Linux 8 squid 7:4.15-10.module+el8.10.0+90877+04e4d7e0.11 ELSA-2026-8317
Oracle Linux 7 squid +2 7:3.5.20-17.0.11.el7_9.13 ELSA-2026-8880

Advisories 30

References