CVE-2026-33526: 
Squid vulnerability analysis and mitigation

CVE-2026-33526 is a heap Use-After-Free vulnerability in Squid's ICP (Internet Cache Protocol) request handler, tracked under advisory SQUID-2026:1. It affects all Squid versions from 3.x through 7.4 (specifically Squid 3.x–3.5.28, 4.x–4.17, 5.x–5.9, 6.x–6.14, and 7.x–7.4) that are configured with a non-zero icp_port. The vulnerability was reported on September 7, 2025, with additional vulnerabilities reported January 26, 2026, and officially fixed in the master branch on February 10, 2026; it was publicly disclosed on March 25, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 9.2 (Critical) (GitHub Advisory, oss-security).

The root cause is a heap Use-After-Free (CWE-416) combined with Premature Release of Resource During Expected Lifetime (CWE-826) and Expired Pointer Dereference (CWE-825) in Squid's ICP v2 handler (src/icp_v2.cc). Specifically, when Squid processes a malformed URI in an ICP request, the code called rfc1738_escape() twice in a chained fashion: the result of the first call was passed to the second call, but the first call's result was invalidated (freed) during the second call, creating a use-after-free condition. The fix (commit 8a7d42f) removes the redundant first rfc1738_escape() call, ensuring the freed pointer is never subsequently dereferenced. Exploitation requires only network access to the ICP port (UDP) and no authentication or user interaction, and critically cannot be blocked by icp_access ACL rules (GitHub Commit, GitHub Advisory).

Successful exploitation allows a remote, unauthenticated attacker to cause a reliable and repeatable Denial of Service (DoS) against the Squid proxy service by sending crafted ICP protocol packets. The impact is limited to availability — there is no confidentiality or integrity impact — but the crash or service disruption can be triggered repeatedly, effectively making the proxy permanently unavailable until restarted. Downstream clients relying on the Squid proxy for web access would lose connectivity, and in environments where Squid is a critical network gateway, this could have broad operational impact (GitHub Advisory, oss-security).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017 (1.7%), indicating a low current probability of exploitation in the wild. However, the attack is described as requiring no authentication, no user interaction, and being executable from any network, making it straightforward to weaponize if a PoC were developed (GitHub Advisory).

1. Reconnaissance: Identify Squid proxy instances with ICP enabled by scanning for open UDP ports (default ICP port is 3130) using tools like Nmap (nmap -sU -p 3130 <target>) or Shodan queries for Squid ICP services.
2. Confirm ICP is enabled: Verify the target responds to ICP queries, confirming icp_port is set to a non-zero value. Squid instances with icp_port 0 are not vulnerable.
3. Craft malformed ICP request: Construct an ICP v2 request packet containing a malformed URI with whitespace characters (e.g., spaces or tabs), which triggers the vulnerable code path in icpGetRequest() within src/icp_v2.cc.
4. Send the packet: Transmit the crafted UDP packet to the target's ICP port. The malformed URI causes Squid to call rfc1738_escape() twice in a chained manner, freeing the intermediate buffer and then dereferencing the freed pointer.
5. Trigger DoS: The heap use-after-free causes Squid to crash or enter an unstable state, resulting in service unavailability. The attack can be repeated to prevent service recovery (GitHub Advisory, GitHub Commit, oss-security).

• Network: Unexpected or repeated UDP traffic to port 3130 (or configured ICP port) from external or untrusted IP addresses; ICP packets containing malformed URIs with embedded whitespace characters.
• Logs: Squid access or cache logs showing ICP error responses (ICP_ERR) for requests with malformed URIs; repeated crash/restart entries in system logs (e.g., systemd or syslog showing Squid process termination).
• Process: Squid worker process unexpectedly terminating and restarting; core dump files generated in the Squid working directory following crashes.
• File System: Presence of core dump files (e.g., squid.core or core.*) in /var/spool/squid/ or the configured coredump directory, indicating abnormal process termination (GitHub Advisory).

The definitive fix is to upgrade Squid to version 7.5 or later, which contains the patch (commit 8a7d42f) (GitHub Advisory). For Linux distributions, Red Hat has issued multiple errata (RHSA-2026:6301 for RHEL 9, RHSA-2026:8119 for RHEL 10, RHSA-2026:8317 for RHEL 8, and others) (Red Hat Bugzilla). Amazon Linux 2 and 2023, Ubuntu, Rocky Linux, AlmaLinux, Mageia, and Fedora have also released updated packages. As an immediate workaround for deployments that do not require ICP, disable ICP support by setting icp_port 0 in squid.conf and restarting Squid — note that icp_access deny all rules alone are not sufficient to mitigate this vulnerability. To check if your deployment is vulnerable, run: squid -k parse 2>&1 | grep -E '(icp|udp)_port' | tail -n1 (oss-security).

The vulnerability was discovered by Joshua Rogers of ZeroPath and Asim Viladi Oglu Manizada, and was responsibly disclosed to the Squid project in September 2025 with additional details provided in January 2026 (GitHub Advisory). The advisory was published on the oss-security mailing list by Amos Jeffries on March 25, 2026, and was picked up by multiple vulnerability tracking platforms and Linux distribution security teams shortly after (oss-security). Social media activity on Bluesky and coverage by Linux security news aggregators (linuxsecurity.com, linuxcompatible.org, pro-linux.de) indicates moderate community awareness, consistent with a high-severity but narrowly scoped DoS vulnerability.