CVE-2026-50012 is a medium severity vulnerability in squid-cache squid caused by improper input validation (CWE-20) leading to a heap-based buffer overflow (CWE-122) in the cache digest reply handling function peerDigestSwapInMask. Specifically, the on-the-wire size of a cache digest may exceed the mask_size declared within the digest, allowing a trusted peer to trigger a heap overflow by sending a maliciously crafted reply to a cache_digest request. This vulnerability affects versions prior to 7.6 and requires the software to be compiled with --enable-cache-digests and configured with cache_peer entries. The vulnerability has no known exploits in the wild and is fixed in version 7.6.

Successful exploitation can cause a heap-based buffer overflow, potentially leading to denial of service or other impacts on availability. The vulnerability does not impact confidentiality but can affect integrity and availability. Exploitation requires a trusted peer with the ability to send crafted cache digest replies, limiting the attack surface.

Upgrade squid-cache squid to version 7.6 or later where this vulnerability is fixed. If upgrading is not immediately possible, restrict or monitor trusted peers configured with cache_peer entries and avoid compiling with the --enable-cache-digests option if not needed. Patch status is not explicitly confirmed in the vendor advisory, but the issue is fixed in version 7.6 as stated.