Squid-cache versions before 7.5 contain a vulnerability (CVE-2026-32748) due to premature release of resources and heap use-after-free bugs during ICP traffic processing. This leads to a reliable and repeatable denial of service condition when handling ICP requests. The vulnerability specifically impacts Squid instances configured with ICP support enabled (non-zero icp_port). Attempts to mitigate by denying ICP queries with icp_access rules are ineffective. The issue is addressed in Squid version 7.5. Red Hat has published multiple advisories and errata providing patches for affected Red Hat Enterprise Linux versions, including Extended Life Cycle Support 7 variants.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service on the Squid proxy service by exploiting heap use-after-free conditions in ICP traffic handling. This can disrupt proxy availability and potentially impact dependent services. The attack vector is network-based via ICP protocol. The vulnerability does not affect Squid instances without ICP enabled. There are no known exploits in the wild at this time.

A fixed version of Squid is available in version 7.5 and later. Users should upgrade to Squid 7.5 or apply vendor-provided patches. Red Hat has released security updates for affected RHEL 7 Extended Life Cycle Support packages that address this vulnerability. Since denying ICP queries using icp_access rules does not mitigate the issue, upgrading or patching is the recommended remediation. Patch status is confirmed by multiple Red Hat advisories linked in the vendor advisory content.