CVE-2026-33515 Squid has issues in ICP message handling
Remote attackers can read sensitive memory via invalid ICP requests in Squid if ICP support is explicitly enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33515?
CVE-2026-33515 is a medium-severity vulnerability in Squid-Cache Squid, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.
Which versions are affected by CVE-2026-33515?
It affects 1 product.
Products include Squid-Cache Squid.
How do I fix CVE-2026-33515?
Upgrade to a fixed version.
Is CVE-2026-33515 being exploited?
There is no known exploitation of CVE-2026-33515 in the wild and no public exploit code.
Other vulnerabilities in Squid-Cache Squid
- CVE-2025-62168 Squid vulnerable to information disclosure via authentication credential leakage in error handling
- CVE-2025-54574 Squid's URN Handling can lead to Buffer Overflow
- CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling
- CVE-2026-32748 Squid has Denial of Service in ICP Response handling
- CVE-2023-50269 SQUID-2023:10 Denial of Service in HTTP Request parsing
Sources
Also known as AZL-80765, CLSA-2026-1779462193, DEBIAN-CVE-2026-33515, GHSA-84p4-hcx7-jj7c, MINI-x22r-37qg-625w, UBUNTU-CVE-2026-33515.