PT-2026-28159 · Squid+4 · Squid+5

Published 2026-01-01 · Updated 2026-05-08 · CVE-2026-32748

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L

Name of the Vulnerable Software and Affected Versions Squid versions prior to 7.5

Description Squid is a caching proxy for the Web. Versions prior to 7.5 are susceptible to a Denial of Service when handling ICP traffic due to premature resource release and heap Use-After-Free bugs. A remote attacker can perform a reliable and repeatable Denial of Service attack against the Squid service using the ICP protocol. This attack is limited to deployments that explicitly enable ICP support by configuring a non-zero icp port. Denying ICP queries using icp access rules does not mitigate this issue.

Recommendations Update to version 7.5 or later.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-826

CWE-413

CWE-416

Related Identifiers

ALSA-2026:6301

ALSA-2026:8119

ALSA-2026:8317

BDU:2026-07191

CVE-2026-32748

GHSA-F9P7-3JQG-HHVQ

MGASA-2026-0094

RHSA-2026:10255

RHSA-2026:10256

RHSA-2026:10257

RHSA-2026:11901

RHSA-2026:6301

RHSA-2026:8119

RHSA-2026:8317

RHSA-2026:8880

RHSA-2026:9220

USN-8157-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Squid

Squid Cache

Ubuntu

References · 48

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32748.json · Exploit
• https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab7481b · Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-6301.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-32748 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-32748 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:6301 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-32748 · Security Note
• https://ubuntu.com/security/CVE-2026-33526 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:6301 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-8880.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2026/03/25/3 · Patch
• https://osv.dev/vulnerability/USN-8157-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0094 · Vendor Advisory