Out-of-bounds read in Squid - CVE-2026-33515

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU124611

Out-of-bounds read in Squid - CVE-2026-33515

Published: March 25, 2026


Vulnerability identifier: #VU124611
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33515
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper input validation in ICP message handling when processing ICP traffic. A remote attacker can send a specially crafted ICP request to disclose small amounts of memory potentially containing sensitive information.

The attack is limited to Squid deployments that explicitly enable ICP support (i.e., configure a non-zero icp_port).


Affected software

Squid
Debian Linux
openEuler
Ubuntu
squid
squid-debuginfo
squid-debugsource
squid (Ubuntu package)
squid (Debian package)

How to mitigate CVE-2026-33515

Install security update from vendor's website.

Squid - update to 7.5
squid - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid-debuginfo - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid-debugsource - addressed in versions 4.9-26, 4.9-30, 6.6-8
squid (Ubuntu package) - addressed in versions 5.9-0ubuntu0.22.04.5, 6.14-0ubuntu0.24.04.2, 6.14-0ubuntu0.25.10.2
squid (Debian package) - update to 6.13-2+deb13u2

External References

Related Security Bulletins