CVE-2026-33515
Fixed in a distro release EPSS 1%CVSS 6.9
Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.
Products: squid-cache squid
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | squid | 5.7-2+deb12u6 |
| Debian 13 | squid | 6.13-2+deb13u2 |
| Debian 14 | squid | 7.5-1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | squid | 6.14-150600.3.20.1 |
| SUSE Linux Enterprise Server 15 SP6-LTSS | squid | 6.14-150600.3.20.1 |
| SUSE Linux Enterprise Server 16.0 | squid | 6.14-160000.1.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | squid | 6.14-150600.3.20.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | squid | 6.14-160000.1.1 |
| Ubuntu 22.04 LTS | squid | 5.9-0ubuntu0.22.04.8 |
| Ubuntu 22.04 LTS | squid | 5.9-0ubuntu0.22.04.5 |
| Ubuntu 24.04 LTS | squid | 6.14-0ubuntu0.24.04.5 |
| Ubuntu 24.04 LTS | squid | 6.14-0ubuntu0.24.04.2 |
| Ubuntu 25.10 | squid | 6.14-0ubuntu0.25.10.2 |
| Ubuntu Pro 16.04 LTS | squid3 | 3.5.12-1ubuntu7.16+esm7 |
| Ubuntu Pro 18.04 LTS | squid3 | 3.5.27-1ubuntu1.14+esm6 |
| Ubuntu Pro 20.04 LTS | squid | 4.10-1ubuntu1.13+esm3 |
| openSUSE Leap 16.0 | squid | 6.14-160000.1.1 |
| openSUSE Tumbleweed | squid | 7.7-2.1 |