Every CVE Search/ Get API key

CVE-2026-33526

Squid vulnerable to Denial of Service in ICP Request handling

9.2 CriticalFix available

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

9.08%Up 7.1 points since Mar 26, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.2

Squid vulnerable to Denial of Service in ICP Request handling

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
CVE-2026-33526
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416, CWE-826, CWE-825
Updated
2026-11-02
EUVDEUVD-2026-16068 9.2

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
EUVD-2026-16068
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
NVD 9.2

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
CVE-2026-33526
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-416, CWE-826, CWE-825
Updated
2026-11-02
OSV 9.2

Squid vulnerable to Denial of Service in ICP Request handling

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
CVE-2026-33526
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Weakness
CWE-416, CWE-826
Updated
2026-11-02
OSVDEBIAN-CVE-2026-33526 7.5

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
DEBIAN-CVE-2026-33526
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1795 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a widely used proxy caching server. Due to premature release of resources and heap Use-After-Free bugs during the handling of ICP (Internet Cache Protocol) traffic, Squid is vulnerable to Denial of Service. A remote attacker can cause the Squid service to crash by sending specially crafted ICP requests to a Squid instance with ICP support enabled, resulting in a reliable and repeatable Denial of Service attack. This vulnerability only affects Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port). It is important to note that this problem cannot be mitigated by denying ICP queries using icp_access rules.(CVE-2026-32748)

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1795
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
Show 47 moreShow less
OSVOESA-2026-1796 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a widely used proxy caching server. Due to premature release of resources and heap Use-After-Free bugs during the handling of ICP (Internet Cache Protocol) traffic, Squid is vulnerable to Denial of Service. A remote attacker can cause the Squid service to crash by sending specially crafted ICP requests to a Squid instance with ICP support enabled, resulting in a reliable and repeatable Denial of Service attack. This vulnerability only affects Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port). It is important to note that this problem cannot be mitigated by denying ICP queries using icp_access rules.(CVE-2026-32748)

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1796
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
OSVOESA-2026-1797 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a widely used proxy caching server. Due to premature release of resources and heap Use-After-Free bugs during the handling of ICP (Internet Cache Protocol) traffic, Squid is vulnerable to Denial of Service. A remote attacker can cause the Squid service to crash by sending specially crafted ICP requests to a Squid instance with ICP support enabled, resulting in a reliable and repeatable Denial of Service attack. This vulnerability only affects Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port). It is important to note that this problem cannot be mitigated by denying ICP queries using icp_access rules.(CVE-2026-32748)

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1797
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
OSVOESA-2026-1798 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1798
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
OSVOESA-2026-1799 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1799
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
OSVOESA-2026-1800 9.2

squid security update

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

Squid is a widely used proxy caching server. Due to premature release of resources and heap Use-After-Free bugs during the handling of ICP (Internet Cache Protocol) traffic, Squid is vulnerable to Denial of Service. A remote attacker can cause the Squid service to crash by sending specially crafted ICP requests to a Squid instance with ICP support enabled, resulting in a reliable and repeatable Denial of Service attack. This vulnerability only affects Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port). It is important to note that this problem cannot be mitigated by denying ICP queries using icp_access rules.(CVE-2026-32748)

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33515)

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.(CVE-2026-33526)

Record
OESA-2026-1800
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Updated
2026-11-02
OSVRHSA-2026:10255 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:10255
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:10256 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:10256
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:10257 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:10257
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:11901 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:11901
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20564 7.5

Red Hat Security Advisory: squid:4 security update

Record
RHSA-2026:20564
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20565 7.5

Red Hat Security Advisory: squid:4 security update

Record
RHSA-2026:20565
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:20580 7.5

Red Hat Security Advisory: squid:4 security update

Record
RHSA-2026:20580
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:6301 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:6301
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8119 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:8119
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8317 7.5

Red Hat Security Advisory: squid:4 security update

Record
RHSA-2026:8317
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:8880 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:8880
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:9220 7.5

Red Hat Security Advisory: squid security update

Record
RHSA-2026:9220
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:6301 7.5

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:6301
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:8119 7.5

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:8119
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:8317 7.5

Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:8317
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-33526 9.2

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
UBUNTU-CVE-2026-33526
CVSS 4.0
9.2 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:6301 No score

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)
  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:6301
Updated
2026-11-02
OSVALSA-2026:8119 No score

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)
  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:8119
Updated
2026-11-02
OSVALSA-2026:8317 No score

Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

  • squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)
  • Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:8317
Updated
2026-11-02
OSVAZL-80762 No score

CVE-2026-33526 affecting package squid for versions less than 6.13-4

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Record
AZL-80762
Updated
2026-11-05
OSVCLSA-2026-1774622460 No score

squid: Fix of 3 CVEs

  • CVE-2025-59362: fix ASN.1 encoding of long SNMP OIDs
  • CVE-2026-33526: do not escape malformed URI twice when sending ICP errors
  • CVE-2026-33515: fix validation of ICP packet sizes and URLs
Record
CLSA-2026-1774622460
Updated
2026-11-02
OSVCLSA-2026-1774874340 No score

squid: Fix of 3 CVEs

  • CVE-2026-33526: fix heap use-after-free due to double rfc1738_escape in ICP error handling
  • CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads
  • CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling
Record
CLSA-2026-1774874340
Updated
2026-11-02
OSVCLSA-2026-1774874764 No score

squid: Fix of 3 CVEs

  • CVE-2026-33526: fix heap use-after-free due to double rfc1738_escape in ICP error handling
  • CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads
  • CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling
Record
CLSA-2026-1774874764
Updated
2026-11-02
OSVCLSA-2026-1774877548 No score

squid: Fix of 3 CVEs

  • CVE-2026-33526: fix heap use-after-free due to double rfc1738_escape in ICP error handling
  • CVE-2026-33515: fix validation of ICP packet sizes and URLs to prevent out-of-bounds reads
  • CVE-2026-32748: fix HttpRequest use-after-free in ICP v3 query handling
Record
CLSA-2026-1774877548
Updated
2026-11-02
OSVCLSA-2026-1774946829 No score

squid: Fix of 3 CVEs

  • CVE-2026-33526: fix heap Use-After-Free in ICP traffic handling causing DoS
  • CVE-2026-33515: fix out-of-bounds read in ICP message handling leaking sensitive information
  • CVE-2026-32748: fix HttpRequest lifetime in ICP v3 queries preventing Use-After-Free DoS
Record
CLSA-2026-1774946829
Updated
2026-11-02
OSVCLSA-2026-1774947465 No score

Fix CVE(s): CVE-2026-32748, CVE-2026-33515, CVE-2026-33526

  • SECURITY UPDATE: Denial of Service in ICP request handling via double rfc1738_escape() call causing heap use-after-free
    • debian/patches/CVE-2026-33526.patch: Remove redundant rfc1738_escape() call in icpGetRequest()
    • CVE-2026-33526
  • SECURITY UPDATE: Denial of Service in ICP v3 query handling via use-after-free of HttpRequest object
    • debian/patches/CVE-2026-32748.patch: Add proper HTTPMSGLOCK/HTTPMSGUNLOCK to doV3Query() to match doV2Query() locking pattern
    • CVE-2026-32748
  • SECURITY UPDATE: Out-of-bounds read in ICP message handling allows information disclosure
    • debian/patches/CVE-2026-33515.patch: Add icpGetUrl() validation function to check packet bounds and NUL-termination of URLs in ICP messages
    • CVE-2026-33515
Record
CLSA-2026-1774947465
Updated
2026-11-02
OSVCLSA-2026-1774947708 No score

squid: Fix of 3 CVEs

  • CVE-2026-33526: fix heap Use-After-Free in ICP traffic handling causing DoS
  • CVE-2026-33515: fix out-of-bounds read in ICP message handling leaking sensitive information
  • CVE-2026-32748: fix HttpRequest lifetime in ICP v3 queries preventing Use-After-Free DoS
Record
CLSA-2026-1774947708
Updated
2026-11-02
OSVCLSA-2026-1775062103 No score

squid34: Fix of 2 CVEs

  • CVE-2026-33526: fix heap Use-After-Free in ICP traffic handling causing DoS
  • CVE-2026-32748: fix HttpRequest lifetime in ICP v3 queries preventing Use-After-Free DoS
Record
CLSA-2026-1775062103
Updated
2026-11-02
OSVCLSA-2026-1775062580 No score

squid34: Fix of 2 CVEs

  • CVE-2026-33526: fix heap Use-After-Free in ICP traffic handling causing DoS
  • CVE-2026-32748: fix HttpRequest lifetime in ICP v3 queries preventing Use-After-Free DoS
Record
CLSA-2026-1775062580
Updated
2026-11-02
OSVCLSA-2026-1775209032 No score

squid: Fix of 2 CVEs

  • CVE-2026-33515: fix validation of packet sizes and URLs in ICP
  • CVE-2026-33526: fix escaping malformed URI twice when sending ICP errors
Record
CLSA-2026-1775209032
Updated
2026-11-02
OSVCLSA-2026-1775688811 No score

Fix CVE(s): CVE-2026-32748, CVE-2026-33526

  • SECURITY UPDATE: denial of service via use-after-free in ICP
    • debian/patches/CVE-2026-33526.patch: remove duplicate rfc1738_escape call in icpGetRequest that invalidated the previously escaped URL pointer
    • CVE-2026-33526
  • SECURITY UPDATE: denial of service via use-after-free in ICP request handling
    • debian/patches/CVE-2026-32748.patch: return HttpRequestPointer and move icpAccessAllowed into icpGetRequest to fix HttpRequest lifetime for ICP v3 queries
    • CVE-2026-32748
Record
CLSA-2026-1775688811
Updated
2026-11-02
OSVCLSA-2026-1775724625 No score

Fix CVE(s): CVE-2026-32748, CVE-2026-33526

  • SECURITY UPDATE: denial of service via use-after-free in ICP
    • debian/patches/CVE-2026-33526.patch: remove duplicate rfc1738_escape call in icpGetRequest that invalidated the previously escaped URL pointer
    • CVE-2026-33526
  • SECURITY UPDATE: denial of service via use-after-free in ICP request handling
    • debian/patches/CVE-2026-32748.patch: return HttpRequestPointer and move icpAccessAllowed into icpGetRequest to fix HttpRequest lifetime for ICP v3 queries
    • CVE-2026-32748
Record
CLSA-2026-1775724625
Updated
2026-11-02
OSVCLSA-2026-1775734284 No score

Fix CVE(s): CVE-2026-32748, CVE-2026-33526

  • SECURITY UPDATE: denial of service via use-after-free in ICP
    • debian/patches/CVE-2026-33526.patch: remove duplicate rfc1738_escape call in icpGetRequest that invalidated the previously escaped URL pointer
    • CVE-2026-33526
  • SECURITY UPDATE: denial of service via use-after-free in ICP request handling
    • debian/patches/CVE-2026-32748.patch: return HttpRequestPointer and move icpAccessAllowed into icpGetRequest to fix HttpRequest lifetime for ICP v3 queries
    • CVE-2026-32748
Record
CLSA-2026-1775734284
Updated
2026-11-02
OSVCLSA-2026-1776173582 No score

squid: Fix of 3 CVEs

  • CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries
  • CVE-2026-33515: ICP: fix validation of packet sizes and URLs
  • CVE-2026-33526: do not escape malformed URI twice when sending ICP errors
Record
CLSA-2026-1776173582
Updated
2026-11-02
OSVCLSA-2026-1776174115 No score

squid: Fix of 3 CVEs

  • CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries
  • CVE-2026-33515: ICP: fix validation of packet sizes and URLs
  • CVE-2026-33526: do not escape malformed URI twice when sending ICP errors
Record
CLSA-2026-1776174115
Updated
2026-11-02
OSVCLSA-2026-1776174481 No score

squid: Fix of 3 CVEs

  • CVE-2026-32748: ICP: fix HttpRequest lifetime for ICP v3 queries
  • CVE-2026-33515: ICP: fix validation of packet sizes and URLs
  • CVE-2026-33526: do not escape malformed URI twice when sending ICP errors
Record
CLSA-2026-1776174481
Updated
2026-11-02
OSVMGASA-2026-0094 No score

Updated squid packages fix security vulnerabilities

Squid mishandles ASN.1 encoding of long SNMP OIDs. This occurs in asn_build_objid in lib/snmplib/asn1.c. (CVE-2025-59362) Squid vulnerable to information disclosure via authentication credential leakage in error handling. (CVE-2025-62168) Squid vulnerable to Denial of Service in ICP Request handling. (CVE-2026-33526) Squid has Denial of Service in ICP Response handling. (CVE-2026-32748) Squid has issues in ICP message handling. (CVE-2026-33515)

Record
MGASA-2026-0094
Updated
2026-11-02
OSVopenSUSE-SU-2026:22080-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
  • CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
  • CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
  • CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
  • CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

Update to 6.14:

  • Do not leak HttpReply when checking http_reply_access (bsc#1237027)
Record
openSUSE-SU-2026:22080-1
Updated
2026-11-02
OSVSUSE-SU-2026:24224-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
  • CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
  • CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
  • CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
  • CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

Update to 6.14:

  • Do not leak HttpReply when checking http_reply_access (bsc#1237027)
Record
SUSE-SU-2026:24224-1
Updated
2026-11-02
OSVSUSE-SU-2026:4621-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
  • CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
  • CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
  • CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
  • CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

  • Do not leak HttpReply when checking http_reply_access (bsc#1237027)
  • Updated to version 6.14
Record
SUSE-SU-2026:4621-1
Updated
2026-11-02
OSVSUSE-SU-2026:4909-1 No score

Security update for squid

This update for squid fixes the following issues:

  • CVE-2023-5824: Multiple issues in HTTP response caching (bsc#1216496).
  • CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature (bsc#1217825).
  • CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads to the disclosure of credentials a trusted client uses to authenticate (bsc#1252281).
  • CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
  • CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
  • CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
  • CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
  • CVE-2026-50012: Improper Input Validation bug (bsc#1268320).
Record
SUSE-SU-2026:4909-1
Updated
2026-11-02
OSVUSN-8941-1 No score

squid, squid3 vulnerabilities

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642)

It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012)

It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729)

It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526)

It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)

Record
USN-8941-1
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
squid
AlmaLinux:9
From an advisory covering 2 CVEs
 before 7:5.5-22.el9_7.4
7:5.5-22.el9_7.4
squid
AlmaLinux:10
From an advisory covering 2 CVEs
 before 7:6.10-6.el10_1.3
7:6.10-6.el10_1.3
libecap
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
libecap
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0.1-2.module_el8.6.0+3048+383bc947
1.0.1-2.module_el8.6.0+3048+383bc947
libecap-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0.1-2.module_el8.6.0+2741+01592ae8
1.0.1-2.module_el8.6.0+2741+01592ae8
libecap-devel
AlmaLinux:8
From an advisory covering 2 CVEs
 before 1.0.1-2.module_el8.6.0+3048+383bc947
1.0.1-2.module_el8.6.0+3048+383bc947
squid
AlmaLinux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module_el8.10.0+4163+e77fcdac.11
7:4.15-10.module_el8.10.0+4163+e77fcdac.11
squid
Azure Linux:3
 before 6.13-4
6.13-4
squid
TuxCare:AlmaLinux:9.2
From an advisory covering 3 CVEs
 before 7:5.5-5.el9_2.1.tuxcare.els11
7:5.5-5.el9_2.1.tuxcare.els11
squid
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
Show 161 moreShow less
Affected packages
PackageAffectedFixed
squid-migration-script
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid-sysvinit
TuxCare:OracleLinux:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid
TuxCare:CentOS:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid-migration-script
TuxCare:CentOS:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid-sysvinit
TuxCare:CentOS:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid-migration-script
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid-sysvinit
TuxCare:RHEL:7
From an advisory covering 3 CVEs
 before 7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
7:3.5.20-17.0.5.el7_9.99.tuxcare.els4
squid
TuxCare:CentOS:6
From an advisory covering 3 CVEs
 before 7:3.1.23-30.el6.tuxcare.els16
7:3.1.23-30.el6.tuxcare.els16
squid
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squid-cgi
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squid-common
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squid-purge
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squid3
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squidclient
TuxCare:Debian:10
From an advisory covering 3 CVEs
 before 4.6-1+deb10u10+tuxcare.els4
4.6-1+deb10u10+tuxcare.els4
squid
TuxCare:OracleLinux:6
From an advisory covering 3 CVEs
 before 7:3.1.23-30.el6.tuxcare.els16
7:3.1.23-30.el6.tuxcare.els16
squid34
TuxCare:OracleLinux:6
From an advisory covering 2 CVEs
 before 7:3.4.14-16.el6.tuxcare.els12
7:3.4.14-16.el6.tuxcare.els12
squid34
TuxCare:CentOS:6
From an advisory covering 2 CVEs
 before 7:3.4.14-16.el6.tuxcare.els12
7:3.4.14-16.el6.tuxcare.els12
squid
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 7:5.5-19.el9_6.1.tuxcare.els3
7:5.5-19.el9_6.1.tuxcare.els3
squid
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squid-cgi
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squid-common
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squid-purge
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squid3
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squidclient
TuxCare:Ubuntu:18.04
From an advisory covering 2 CVEs
 before 3.5.27-1ubuntu1.14+tuxcare.els11
3.5.27-1ubuntu1.14+tuxcare.els11
squid
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squid-cgi
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squid-common
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squid-purge
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squid3
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squidclient
TuxCare:Ubuntu:16.04
From an advisory covering 2 CVEs
 before 3.5.12-1ubuntu7.17+tuxcare.els13
3.5.12-1ubuntu7.17+tuxcare.els13
squid
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 4.10-1ubuntu1.13+tuxcare.els2
4.10-1ubuntu1.13+tuxcare.els2
squid-cgi
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 4.10-1ubuntu1.13+tuxcare.els2
4.10-1ubuntu1.13+tuxcare.els2
squid-common
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 4.10-1ubuntu1.13+tuxcare.els2
4.10-1ubuntu1.13+tuxcare.els2
squid-purge
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 4.10-1ubuntu1.13+tuxcare.els2
4.10-1ubuntu1.13+tuxcare.els2
squidclient
TuxCare:Ubuntu:20.04
From an advisory covering 2 CVEs
 before 4.10-1ubuntu1.13+tuxcare.els2
4.10-1ubuntu1.13+tuxcare.els2
squid
TuxCare:CentOS-Stream:8
From an advisory covering 3 CVEs
 before 7:4.15-10.module_el8+2367+3575bad4.tuxcare.els5
7:4.15-10.module_el8+2367+3575bad4.tuxcare.els5
squid
TuxCare:CentOS:8.5
From an advisory covering 3 CVEs
 before 7:4.15-1.module_el8.5.0+2369+dcd66620.tuxcare.els15
7:4.15-1.module_el8.5.0+2369+dcd66620.tuxcare.els15
squid
TuxCare:CentOS:8.4
From an advisory covering 3 CVEs
 before 7:4.11-4.module_el8.4.0+2368+2ccdb625.2.tuxcare.els16
7:4.11-4.module_el8.4.0+2368+2ccdb625.2.tuxcare.els16
squid
Debian:12
 before 5.7-2+deb12u6, plus listed versions
5.7-25.7-2+deb12u15.7-2+deb12u25.7-2+deb12u35.7-2+deb12u45.7-2+deb12u5
5.7-2+deb12u6
squid
Debian:13
 before 6.13-2+deb13u2, plus listed versions
6.13-26.13-2+deb13u1
6.13-2+deb13u2
squid
Debian:14
 before 7.5-1, plus listed versions
6.13-27.1-17.2-17.2-27.4-1
7.5-1
squid
Mageia:9
From an advisory covering 5 CVEs
 before 5.9-1.5.mga9
5.9-1.5.mga9
squid
openEuler:24.03-LTS-SP1
From an advisory covering 3 CVEs
 before 6.6-8.oe2403sp1
6.6-8.oe2403sp1
squid
openEuler:24.03-LTS-SP2
From an advisory covering 3 CVEs
 before 6.6-8.oe2403sp2
6.6-8.oe2403sp2
squid
openEuler:24.03-LTS-SP3
From an advisory covering 3 CVEs
 before 6.6-8.oe2403sp3
6.6-8.oe2403sp3
squid
openEuler:20.03-LTS-SP4
From an advisory covering 2 CVEs
 before 4.9-26.oe2003sp4
4.9-26.oe2003sp4
squid
openEuler:22.03-LTS-SP4
From an advisory covering 2 CVEs
 before 4.9-30.oe2203sp4
4.9-30.oe2203sp4
squid
openEuler:24.03-LTS
From an advisory covering 3 CVEs
 before 6.6-8.oe2403
6.6-8.oe2403
squid
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 7:5.5-13.el9_4.5
7:5.5-13.el9_4.5
squid-debuginfo
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 7:5.5-13.el9_4.5
7:5.5-13.el9_4.5
squid-debugsource
Red Hat:rhel_eus:9.4::appstream
From an advisory covering 2 CVEs
 before 7:5.5-13.el9_4.5
7:5.5-13.el9_4.5
squid
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 2 CVEs
 before 7:5.2-1.el9_0.10
7:5.2-1.el9_0.10
squid-debuginfo
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 2 CVEs
 before 7:5.2-1.el9_0.10
7:5.2-1.el9_0.10
squid-debugsource
Red Hat:rhel_e4s:9.0::appstream
From an advisory covering 2 CVEs
 before 7:5.2-1.el9_0.10
7:5.2-1.el9_0.10
squid
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 7:5.5-5.el9_2.11
7:5.5-5.el9_2.11
squid-debuginfo
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 7:5.5-5.el9_2.11
7:5.5-5.el9_2.11
squid-debugsource
Red Hat:rhel_e4s:9.2::appstream
From an advisory covering 2 CVEs
 before 7:5.5-5.el9_2.11
7:5.5-5.el9_2.11
squid
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 7:6.10-5.el10_0.2
7:6.10-5.el10_0.2
squid-debuginfo
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 7:6.10-5.el10_0.2
7:6.10-5.el10_0.2
squid-debugsource
Red Hat:enterprise_linux_eus:10.0
From an advisory covering 2 CVEs
 before 7:6.10-5.el10_0.2
7:6.10-5.el10_0.2
libecap
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
squid-debuginfo
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
squid-debugsource
Red Hat:rhel_aus:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
libecap
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
squid-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
squid-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
From an advisory covering 2 CVEs
 before 7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
7:4.11-4.module+el8.4.0+24287+ae9ea41b.11
libecap
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debuginfo
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debugsource
Red Hat:rhel_aus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
libecap
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debuginfo
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debugsource
Red Hat:rhel_e4s:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
libecap
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debuginfo
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
squid-debugsource
Red Hat:rhel_tus:8.6::appstream
From an advisory covering 2 CVEs
 before 7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
7:4.15-3.module+el8.6.0+24307+cba8e5bb.9
libecap
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
squid-debuginfo
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
squid-debugsource
Red Hat:rhel_e4s:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
libecap
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
libecap-devel
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.1.0+4044+36416a77
0:1.0.1-2.module+el8.1.0+4044+36416a77
squid
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
squid-debuginfo
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
squid-debugsource
Red Hat:rhel_tus:8.8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-6.module+el8.8.0+24284+6402ee68.10
7:4.15-6.module+el8.8.0+24284+6402ee68.10
squid
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 7:5.5-22.el9_7.4
7:5.5-22.el9_7.4
squid-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 7:5.5-22.el9_7.4
7:5.5-22.el9_7.4
squid-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 2 CVEs
 before 7:5.5-22.el9_7.4
7:5.5-22.el9_7.4
squid
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 7:6.10-6.el10_1.3
7:6.10-6.el10_1.3
squid-debuginfo
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 7:6.10-6.el10_1.3
7:6.10-6.el10_1.3
squid-debugsource
Red Hat:enterprise_linux:10.1
From an advisory covering 2 CVEs
 before 7:6.10-6.el10_1.3
7:6.10-6.el10_1.3
libecap
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.9.0+19703+a1da7223
0:1.0.1-2.module+el8.9.0+19703+a1da7223
libecap-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.9.0+19703+a1da7223
0:1.0.1-2.module+el8.9.0+19703+a1da7223
libecap-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.9.0+19703+a1da7223
0:1.0.1-2.module+el8.9.0+19703+a1da7223
libecap-devel
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.9.0+19703+a1da7223
0:1.0.1-2.module+el8.9.0+19703+a1da7223
squid
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+24189+04a20c8a.11
7:4.15-10.module+el8.10.0+24189+04a20c8a.11
squid-debuginfo
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+24189+04a20c8a.11
7:4.15-10.module+el8.10.0+24189+04a20c8a.11
squid-debugsource
Red Hat:enterprise_linux:8::appstream
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+24189+04a20c8a.11
7:4.15-10.module+el8.10.0+24189+04a20c8a.11
squid
Red Hat:rhel_els:7
From an advisory covering 2 CVEs
 before 7:3.5.20-17.el7_9.16
7:3.5.20-17.el7_9.16
squid
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 7:5.5-19.el9_6.3
7:5.5-19.el9_6.3
squid-debuginfo
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 7:5.5-19.el9_6.3
7:5.5-19.el9_6.3
squid-debugsource
Red Hat:rhel_eus:9.6::appstream
From an advisory covering 2 CVEs
 before 7:5.5-19.el9_6.3
7:5.5-19.el9_6.3
squid
Rocky Linux:9
From an advisory covering 2 CVEs
 before 7:5.5-22.el9_7.4
7:5.5-22.el9_7.4
squid
Rocky Linux:10
From an advisory covering 2 CVEs
 before 7:6.10-6.el10_1.3
7:6.10-6.el10_1.3
libecap
Rocky Linux:8
From an advisory covering 2 CVEs
 before 0:1.0.1-2.module+el8.9.0+1437+df5ea8f0
0:1.0.1-2.module+el8.9.0+1437+df5ea8f0
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+1928+e8441768.5
7:4.15-10.module+el8.10.0+1928+e8441768.5
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+1985+eaf982f0.6
7:4.15-10.module+el8.10.0+1985+eaf982f0.6
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+1885+e30b7122.3
7:4.15-10.module+el8.10.0+1885+e30b7122.3
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+2080+49064dbd.9
7:4.15-10.module+el8.10.0+2080+49064dbd.9
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+1758+80ba9f4b
7:4.15-10.module+el8.10.0+1758+80ba9f4b
squid
Rocky Linux:8
From an advisory covering 2 CVEs
 before 7:4.15-10.module+el8.10.0+1881+7e31fb44.1
7:4.15-10.module+el8.10.0+1881+7e31fb44.1
squid
SUSE:Linux Enterprise Server 16.0
From an advisory covering 5 CVEs
 before 6.14-160000.1.1
6.14-160000.1.1
squid
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 5 CVEs
 before 6.14-160000.1.1
6.14-160000.1.1
squid
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 5 CVEs
 before 6.14-150600.3.20.1
6.14-150600.3.20.1
squid
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 5 CVEs
 before 6.14-150600.3.20.1
6.14-150600.3.20.1
squid
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 5 CVEs
 before 6.14-150600.3.20.1
6.14-150600.3.20.1
squid
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 8 CVEs
 before 5.7-150400.3.41.1
5.7-150400.3.41.1
squid3
Ubuntu:Pro:16.04:LTS
 before 3.5.12-1ubuntu7.16+esm7, plus listed versions
3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1
Show 21 moreShow less
3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.123.5.12-1ubuntu7.133.5.12-1ubuntu7.143.5.12-1ubuntu7.153.5.12-1ubuntu7.163.5.12-1ubuntu7.16+esm13.5.12-1ubuntu7.16+esm23.5.12-1ubuntu7.16+esm33.5.12-1ubuntu7.16+esm43.5.12-1ubuntu7.16+esm53.5.12-1ubuntu7.16+esm6
3.5.12-1ubuntu7.16+esm7
squid3
Ubuntu:Pro:18.04:LTS
 before 3.5.27-1ubuntu1.14+esm6, plus listed versions
3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2
Show 17 moreShow less
3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.133.5.27-1ubuntu1.143.5.27-1ubuntu1.14+esm13.5.27-1ubuntu1.14+esm23.5.27-1ubuntu1.14+esm33.5.27-1ubuntu1.14+esm43.5.27-1ubuntu1.14+esm5
3.5.27-1ubuntu1.14+esm6
squid
Ubuntu:Pro:20.04:LTS
 before 4.10-1ubuntu1.13+esm3, plus listed versions
4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3
Show 17 moreShow less
4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.74.10-1ubuntu1.84.10-1ubuntu1.94.10-1ubuntu1.104.10-1ubuntu1.114.10-1ubuntu1.124.10-1ubuntu1.134.10-1ubuntu1.13+esm14.10-1ubuntu1.13+esm2
4.10-1ubuntu1.13+esm3
squid
Ubuntu:22.04:LTS
 before 5.9-0ubuntu0.22.04.5, plus listed versions
4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1
Show 10 moreShow less
5.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.15.7-0ubuntu0.22.04.25.7-0ubuntu0.22.04.35.7-0ubuntu0.22.04.45.9-0ubuntu0.22.04.15.9-0ubuntu0.22.04.25.9-0ubuntu0.22.04.35.9-0ubuntu0.22.04.4
5.9-0ubuntu0.22.04.5
squid
Ubuntu:24.04:LTS
 before 6.14-0ubuntu0.24.04.2, plus listed versions
6.1-2ubuntu16.1-2ubuntu26.5-1ubuntu16.5-1ubuntu26.5-1ubuntu3
Show 8 moreShow less
6.6-1ubuntu46.6-1ubuntu56.6-1ubuntu5.16.10-0ubuntu0.24.04.16.13-0ubuntu0.24.04.16.13-0ubuntu0.24.04.26.13-0ubuntu0.24.04.36.14-0ubuntu0.24.04.1
6.14-0ubuntu0.24.04.2
squid
Ubuntu:25.10
 before 6.14-0ubuntu0.25.10.2, plus listed versions
6.13-1ubuntu16.13-1ubuntu26.13-1ubuntu36.13-1ubuntu46.13-1ubuntu4.16.14-0ubuntu0.25.10.1
6.14-0ubuntu0.25.10.2
squid3
Ubuntu:Pro:16.04:LTS
From an advisory covering 6 CVEs
 before 3.5.12-1ubuntu7.16+esm7, plus listed versions
3.3.8-1ubuntu163.3.8-1ubuntu173.5.12-1ubuntu63.5.12-1ubuntu73.5.12-1ubuntu7.1
Show 21 moreShow less
3.5.12-1ubuntu7.23.5.12-1ubuntu7.33.5.12-1ubuntu7.43.5.12-1ubuntu7.53.5.12-1ubuntu7.63.5.12-1ubuntu7.73.5.12-1ubuntu7.83.5.12-1ubuntu7.93.5.12-1ubuntu7.103.5.12-1ubuntu7.113.5.12-1ubuntu7.123.5.12-1ubuntu7.133.5.12-1ubuntu7.143.5.12-1ubuntu7.153.5.12-1ubuntu7.163.5.12-1ubuntu7.16+esm13.5.12-1ubuntu7.16+esm23.5.12-1ubuntu7.16+esm33.5.12-1ubuntu7.16+esm43.5.12-1ubuntu7.16+esm53.5.12-1ubuntu7.16+esm6
3.5.12-1ubuntu7.16+esm7
squid3
Ubuntu:Pro:18.04:LTS
From an advisory covering 6 CVEs
 before 3.5.27-1ubuntu1.14+esm6, plus listed versions
3.5.23-5ubuntu13.5.23-5ubuntu23.5.27-1ubuntu13.5.27-1ubuntu1.13.5.27-1ubuntu1.2
Show 17 moreShow less
3.5.27-1ubuntu1.33.5.27-1ubuntu1.43.5.27-1ubuntu1.53.5.27-1ubuntu1.63.5.27-1ubuntu1.73.5.27-1ubuntu1.83.5.27-1ubuntu1.93.5.27-1ubuntu1.103.5.27-1ubuntu1.113.5.27-1ubuntu1.123.5.27-1ubuntu1.133.5.27-1ubuntu1.143.5.27-1ubuntu1.14+esm13.5.27-1ubuntu1.14+esm23.5.27-1ubuntu1.14+esm33.5.27-1ubuntu1.14+esm43.5.27-1ubuntu1.14+esm5
3.5.27-1ubuntu1.14+esm6
squid
Ubuntu:Pro:20.04:LTS
From an advisory covering 6 CVEs
 before 4.10-1ubuntu1.13+esm3, plus listed versions
4.8-1ubuntu24.8-1ubuntu34.9-2ubuntu14.9-2ubuntu24.9-2ubuntu3
Show 17 moreShow less
4.9-2ubuntu44.10-1ubuntu14.10-1ubuntu1.14.10-1ubuntu1.24.10-1ubuntu1.34.10-1ubuntu1.44.10-1ubuntu1.54.10-1ubuntu1.64.10-1ubuntu1.74.10-1ubuntu1.84.10-1ubuntu1.94.10-1ubuntu1.104.10-1ubuntu1.114.10-1ubuntu1.124.10-1ubuntu1.134.10-1ubuntu1.13+esm14.10-1ubuntu1.13+esm2
4.10-1ubuntu1.13+esm3
squid
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 5.9-0ubuntu0.22.04.8, plus listed versions
4.13-10ubuntu55.2-1ubuntu15.2-1ubuntu35.2-1ubuntu45.2-1ubuntu4.1
Show 12 moreShow less
5.2-1ubuntu4.25.2-1ubuntu4.35.7-0ubuntu0.22.04.15.7-0ubuntu0.22.04.25.7-0ubuntu0.22.04.35.7-0ubuntu0.22.04.45.9-0ubuntu0.22.04.15.9-0ubuntu0.22.04.25.9-0ubuntu0.22.04.35.9-0ubuntu0.22.04.45.9-0ubuntu0.22.04.55.9-0ubuntu0.22.04.7
5.9-0ubuntu0.22.04.8
squid
Ubuntu:24.04:LTS
From an advisory covering 6 CVEs
 before 6.14-0ubuntu0.24.04.5, plus listed versions
6.1-2ubuntu16.1-2ubuntu26.5-1ubuntu16.5-1ubuntu26.5-1ubuntu3
Show 10 moreShow less
6.6-1ubuntu46.6-1ubuntu56.6-1ubuntu5.16.10-0ubuntu0.24.04.16.13-0ubuntu0.24.04.16.13-0ubuntu0.24.04.26.13-0ubuntu0.24.04.36.14-0ubuntu0.24.04.16.14-0ubuntu0.24.04.26.14-0ubuntu0.24.04.4
6.14-0ubuntu0.24.04.5
squid
openSUSE:Leap 16.0
From an advisory covering 5 CVEs
 before 6.14-160000.1.1
6.14-160000.1.1

History

History
RecordedChangedSources
affectedOSV
facts
affected, aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-33526 is a critical vulnerability (CVSS 9.2) in Squid-cache Squid, published March 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.08%, the 95th percentile. Fixed in squid 6.13-4.

References

Show 100 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open