PT-2026-28164 · Squid+3 · Squid+4

Alex Rousskov + 1 · Published 2026-01-01 · Updated 2026-05-05 · CVE-2026-33515

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Squid versions prior to 7.5

Description Squid, a caching proxy for the Web, contains a flaw due to improper input validation when handling ICP traffic. This can lead to an out-of-bounds read, potentially exposing sensitive information to a remote attacker. The attack requires the Squid deployment to have ICP support enabled via a non-zero icp port configuration. Denying ICP queries using icp access rules does not resolve this issue.

Recommendations Update to version 7.5 or later.

Exploit

Fix

DoS

Out of bounds Read

Weakness Enumeration

CWE-1289

CWE-125

Related Identifiers

BDU:2026-07323

CVE-2026-33515

GHSA-84P4-HCX7-JJ7C

MGASA-2026-0094

USN-8157-1

Affected Products

Linuxmint

Red Os

Squid

Squid Cache

Ubuntu

References · 31

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33515.json · Exploit
• https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165 · Patch
• https://github.com/squid-cache/squid/security/advisories/GHSA-84p4-hcx7-jj7c · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-32748 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33515 · Security Note
• https://ubuntu.com/security/CVE-2026-33515 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33515 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8157-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0094 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33515 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33515 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33515 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33526 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07323 · Security Note