PT-2026-28165 · Squid+4 · Squid+5

Asim Viladi Oglu Manizada + 2 · Published 2026-01-01 · Updated 2026-05-05 · CVE-2026-33526

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Squid versions prior to 7.5

Description Squid, a caching proxy for the Web, contains a heap Use-After-Free issue that can lead to Denial of Service when handling ICP traffic. This allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using the ICP protocol. The attack is limited to deployments that explicitly enable ICP support by configuring a non-zero icp port. Denying ICP queries using icp access rules does not mitigate this issue.

Recommendations Update to version 7.5 or later.

Exploit

Fix

DoS

Use After Free

Weakness Enumeration

CWE-826

CWE-416

Related Identifiers

ALSA-2026:6301

ALSA-2026:8119

ALSA-2026:8317

BDU:2026-07242

CVE-2026-33526

GHSA-HPFX-H48Q-GVWG

MGASA-2026-0094

RHSA-2026:10255

RHSA-2026:10256

RHSA-2026:10257

RHSA-2026:11901

RHSA-2026:6301

RHSA-2026:8119

RHSA-2026:8317

RHSA-2026:8880

RHSA-2026:9220

USN-8157-1

Affected Products

Linuxmint

Red Os

Rocky Linux

Squid

Squid Cache

Ubuntu

References · 50

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33526.json · Exploit
• https://github.com/squid-cache/squid/security/advisories/GHSA-hpfx-h48q-gvwg · Vendor Advisory
• https://github.com/squid-cache/squid/commit/8a7d42f9d44befb8fcbbb619505587c8de6a1e91 · Patch
• https://linux.oracle.com/errata/ELSA-2026-6301.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33515 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-07242 · Security Note
• https://osv.dev/vulnerability/ALSA-2026:6301 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33526 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:6301 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-8880.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-8157-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0094 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33526 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8157-1 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2026-6301.html · Vendor Advisory