PT-2026-28164 · Squid+3 · Squid+4

Alex Rousskov + 1 · Publicado 2026-01-01 · Atualizado 2026-05-05 · CVE-2026-33515

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Squid versions prior to 7.5

Description Squid, a caching proxy for the Web, contains a flaw due to improper input validation when handling ICP traffic. This can lead to an out-of-bounds read, potentially exposing sensitive information to a remote attacker. The attack requires the Squid deployment to have ICP support enabled via a non-zero icp port configuration. Denying ICP queries using icp access rules does not resolve this issue.

Recommendations Update to version 7.5 or later.

Exploit

Correção

DoS

Out of bounds Read

Enumeração de Fraquezas

CWE-1289

CWE-125

Identificadores relacionados

BDU:2026-07323

CVE-2026-33515

GHSA-84P4-HCX7-JJ7C

MGASA-2026-0094

USN-8157-1

Produtos afetados

Linuxmint

Red Os

Squid

Squid Cache

Ubuntu

Referências · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33515.json · Exploit
• https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165 · Correção
• https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c · Aviso do Fabricante
• https://github.com/squid-cache/squid/pull/2220#discussion_r2727683637 · Nota
• https://github.com/squid-cache/squid/pull/2220 · Nota
• https://ubuntu.com/security/CVE-2026-32748 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2037137770397724684 · Publicação no Twitter
• https://cve.org/CVERecord?id=CVE-2026-33515 · Nota de Segurança
• https://twitter.com/TheRabbitPy/status/2037266862954655913 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-33515 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33515 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-8157-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2026-0094 · Aviso do Fabricante
• https://redos.red-soft.ru/search/?iblock_id=&q=CVE-2026-33515 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33515 · Aviso do Fabricante