Squid-cache squid versions before 7.5 contain a heap Use-After-Free vulnerability (CWE-416) triggered during the handling of ICP traffic. This vulnerability enables remote attackers to cause a Denial of Service by exploiting the improper memory management in ICP processing. The attack surface is limited to Squid instances with ICP support enabled (non-zero icp_port). The vulnerability cannot be mitigated by icp_access rules that deny ICP queries. The issue is fixed in Squid version 7.5. Red Hat has issued multiple advisories and errata providing patches for affected Red Hat Enterprise Linux versions.

The vulnerability allows remote unauthenticated attackers to cause a reliable and repeatable Denial of Service against the Squid service by sending crafted ICP traffic. This results in service disruption but does not indicate code execution or data compromise. The attack requires ICP support to be enabled on the target Squid server. Attempts to block ICP queries via icp_access rules do not prevent exploitation.

An official fix is available in Squid version 7.5. Users should upgrade to version 7.5 or later to remediate this vulnerability. Red Hat has released security updates for affected Enterprise Linux versions; applying these vendor-provided patches is recommended. Since denying ICP queries via icp_access rules does not mitigate the issue, upgrading or patching is the only effective remediation.