CVE-2026-32748 Squid has Denial of Service in ICP Response handling

High 8.7 Published 26 Mar 2026 Updated 15 Jul 2026

Remote attackers can cause a denial of service in Squid via ICP traffic if ICP support is explicitly enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-32748?

CVE-2026-32748 is a high-severity use after free vulnerability in Squid-Cache Squid, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

Weakness: CWE-826, CWE-416, CWE-413

Which versions are affected by CVE-2026-32748?

It affects 1 product.

Products include Squid-Cache Squid.

How do I fix CVE-2026-32748?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-32748 being exploited?

There is no known exploitation of CVE-2026-32748 in the wild and no public exploit code.

All Squid-Cache Squid vulnerabilities

Sources

Also known as AZL-80768, CLSA-2026-1775040191, CLSA-2026-1775210281, DEBIAN-CVE-2026-32748, GHSA-f9p7-3jqg-hhvq, MINI-cr4r-jq7q-4943 and 1 more.