CVE-2026-33526 Squid vulnerable to Denial of Service in ICP Request handling

Critical 9.2 Published 26 Mar 2026 Updated 15 Jul 2026

Remote attackers can cause a denial of service in Squid via ICP traffic if ICP support is explicitly enabled.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-33526?

CVE-2026-33526 is a critical use after free vulnerability in Squid-Cache Squid, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

Weakness: CWE-825, CWE-826, CWE-416

Which versions are affected by CVE-2026-33526?

It affects 1 product.

Products include Squid-Cache Squid.

How do I fix CVE-2026-33526?

Upgrade to a fixed version.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-33526 being exploited?

There is no known exploitation of CVE-2026-33526 in the wild and no public exploit code.

All Squid-Cache Squid vulnerabilities

Sources

Also known as AZL-80762, DEBIAN-CVE-2026-33526, GHSA-hpfx-h48q-gvwg, MINI-p2c6-8976-r3qh, UBUNTU-CVE-2026-33526.