SB2026033197 - Red Hat Enterprise Linux 9 update for squid
Published: March 31, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Use After Free (CVE-ID: CVE-2026-33526)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to heap use-after-free in ICP request handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to cause a denial of service.
The attack is limited to Squid deployments that have ICP support enabled via a non-zero icp_port configuration.
2) Use After Free (CVE-ID: CVE-2026-32748)
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in ICP request handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to cause a denial of service.
The vulnerability is only exploitable on Squid deployments that have ICP support enabled via a non-zero icp_port configuration.
Remediation
Install update from vendor's website.