CVE-2026-50012: 
Squid vulnerability analysis and mitigation

CVE-2026-50012 is a heap-based buffer overflow vulnerability in Squid's cache digest reply handling that allows a trusted peer to trigger memory corruption. The flaw resides in the peerDigestSwapInMask function in src/peer_digest.cc, where a cache digest's on-the-wire size may exceed the mask_size declared within the digest, leading to a heap overflow. It affects all Squid versions from 3.x through 7.5 (specifically Squid 3.x–3.5.27, 4.x–4.17, 5.x–5.9, 6.x–6.14, and 7.x–7.5), and is fixed in version 7.6. The vulnerability was initially reported on 2026-05-11, patched on 2026-05-30, and publicly disclosed on 2026-06-14, with a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) leading to a heap-based buffer overflow (CWE-122) in the peerDigestSwapInMask function within src/peer_digest.cc. When Squid processes a cache digest reply from a peer, it copies the incoming mask data into a heap-allocated buffer without first verifying that fetch->mask_offset + size does not exceed pd->cd->mask_size; if the on-the-wire digest data is larger than the declared mask size, a memcpy writes beyond the allocated buffer. The fix adds a bounds check that aborts the fetch with an error if the incoming data would overflow the mask buffer (GitHub Commit, GitHub PR). Exploitation requires the attacker to control or compromise a trusted cache peer configured via cache_peer, and the vulnerable Squid instance must have been compiled with --enable-cache-digests; since cache digests are exchanged over TCP, spoofing is not a viable attack vector (GitHub Advisory).

Successful exploitation can cause denial of service through a crash of the Squid process, and may potentially allow arbitrary code execution depending on heap layout and memory protections in place. Integrity impact is rated low (minor data modification possible), while availability impact is high due to the potential for process termination. Confidentiality is not directly impacted by this vulnerability. The attack is constrained to the peer-to-peer cache digest exchange channel and does not directly expose end-user data or enable lateral movement beyond the Squid proxy process itself (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of disclosure (Feedly). The NVD SSVC assessment classifies exploitation as "none" and the attack as non-automatable, reflecting the requirement for a trusted, configured cache peer relationship. The EPSS score is approximately 0.0225 (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Detection plugins are available from Nessus (IDs: 320883, 321511, 321872, 329264) and Qualys (IDs: 363000, 362906) (Feedly).

1. Identify a target: Locate a Squid proxy instance compiled with --enable-cache-digests and configured with one or more cache_peer entries. This can be verified with: squid -v | grep -q 'enable-cache-digests' && squid -k parse 2>&1 | grep -w cache_peer | grep -v no-digest.
2. Gain position as a trusted peer: The attacker must control or compromise a server that is listed as a trusted cache_peer in the target Squid's configuration, since cache digest exchanges occur over TCP between configured peers.
3. Craft a malicious cache digest reply: Construct a cache digest response where the on-the-wire mask data size exceeds the mask_size field declared in the digest header, creating a mismatch that the unpatched peerDigestSwapInMask function does not validate.
4. Trigger the overflow: Send the maliciously crafted cache digest reply to the target Squid instance in response to a cache_digest request. The vulnerable memcpy in peerDigestSwapInMask will write beyond the allocated heap buffer.
5. Achieve denial of service or code execution: Depending on heap layout and memory protections, the overflow may crash the Squid process (denial of service) or, in a more sophisticated scenario, enable arbitrary code execution within the Squid process context (GitHub Advisory, GitHub Commit).

• Logs: Squid cache log entries containing peer digest mask data too large (message introduced by the fix, indicating exploitation attempts against patched versions); unexpected Squid process crashes or restarts logged in system logs (e.g., /var/log/syslog, /var/log/squid/cache.log).
• Process: Unexpected termination or segmentation fault of the squid process, particularly during cache digest exchange with a peer; core dump files generated in the Squid working directory.
• Network: Anomalous TCP traffic from a configured cache_peer host containing oversized cache digest reply payloads; unexpected connection resets or errors on the cache digest exchange port from a peer.
• File System: Presence of core dump files (e.g., core, squid.core) in the Squid run directory following unexpected process termination (GitHub Advisory, GitHub Commit).

Upgrade Squid to version 7.6 or later, which includes the fix in peerDigestSwapInMask that validates buffer bounds before the memcpy operation (GitHub Release). A patch for the Squid 7.x stable branch is also available at the commit referenced in the advisory. If immediate upgrading is not possible, two workarounds are available: (1) ensure all configured cache_peer entries are fully trusted and under your organizational control to reduce risk, or (2) add the no-digest option to any cache_peer directives you do not directly control, which eliminates the vulnerability at the cost of increased bandwidth (HTCP or ICP can partially offset this) (GitHub Advisory). Administrators can confirm vulnerability by running: squid -v | grep -q 'enable-cache-digests' && squid -k parse 2>&1 | grep -w cache_peer | grep -v no-digest — any output indicates a vulnerable configuration.

The vulnerability was discovered independently by Huy Hoàng Nguyễn of Sun Asterisk Vietnam and Sarthak Munshi, and fixed by Francesco Chemolli of the Squid project (GitHub Advisory). Coverage appeared on security news aggregators including SecurityOnline.info and LinuxSecurity.com shortly after disclosure. The vulnerability received moderate community attention, with discussion on oss-security mailing lists and social media platforms including Mastodon. It was noted alongside other Squid vulnerabilities disclosed around the same period, including the higher-profile "SquidBleed" (CVE-2026-47729) heap over-read, which drew more significant media coverage from outlets such as The Hacker News (Feedly).