Out-of-bounds read in Squid - CVE-2026-33515

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124611

Out-of-bounds read in Squid - CVE-2026-33515

Published: March 25, 2026


Vulnerability identifier: #VU124611
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33515
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in ICP message handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to disclose small amounts of memory potentially containing sensitive information.

The attack is limited to Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port).


Affected software

Squid
SUSE Linux Enterprise Server 15 SP6
Debian Linux
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
Server Applications Module
openSUSE Leap
openEuler
Ubuntu
squid
squid-debuginfo
squid-debugsource
squid (Ubuntu package)
squid (Debian package)

How to mitigate CVE-2026-33515

Install security update from vendor's website.

Squid - update to 7.5
squid - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid-debuginfo - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid-debugsource - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid-debugsource - update to 6.14-150600.3.20.1
squid-debuginfo - update to 6.14-150600.3.20.1
squid - update to 6.14-150600.3.20.1
squid (Ubuntu package) - addressed in versions 5.9-0ubuntu0.22.04.5, 6.14-0ubuntu0.24.04.2, 6.14-0ubuntu0.25.10.2
squid (Debian package) - update to 6.13-2+deb13u2

External References

Related Security Bulletins