Red Hat Security Advisory: squid security update
Two denial of service vulnerabilities have been identified in Squid, a high-performance proxy caching server. These vulnerabilities involve a heap use-after-free issue and crafted ICP traffic handling, potentially causing service disruption. Red Hat has issued an important security advisory with updates for Red Hat Enterprise Linux 9.4 Extended Update Support to address these issues.
AI Analysis
Technical Summary
The vulnerabilities CVE-2026-33526 and CVE-2026-32748 affect Squid's handling of ICP (Internet Cache Protocol) traffic. CVE-2026-33526 is a heap use-after-free vulnerability that can lead to denial of service, while CVE-2026-32748 involves denial of service via crafted ICP traffic. Red Hat Product Security has released updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support to remediate these issues. The advisory classifies the security impact as Important.
Potential Impact
Successful exploitation of these vulnerabilities can cause denial of service conditions in Squid proxy servers, disrupting proxy caching services for web clients. There are no known exploits in the wild at this time. The impact is limited to service availability degradation.
Mitigation Recommendations
Red Hat has released updated Squid packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:10255. No additional mitigation actions are indicated beyond applying the official update.
Red Hat Security Advisory: squid security update
Description
Two denial of service vulnerabilities have been identified in Squid, a high-performance proxy caching server. These vulnerabilities involve a heap use-after-free issue and crafted ICP traffic handling, potentially causing service disruption. Red Hat has issued an important security advisory with updates for Red Hat Enterprise Linux 9.4 Extended Update Support to address these issues.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerabilities CVE-2026-33526 and CVE-2026-32748 affect Squid's handling of ICP (Internet Cache Protocol) traffic. CVE-2026-33526 is a heap use-after-free vulnerability that can lead to denial of service, while CVE-2026-32748 involves denial of service via crafted ICP traffic. Red Hat Product Security has released updated packages for Red Hat Enterprise Linux 9.4 Extended Update Support to remediate these issues. The advisory classifies the security impact as Important.
Potential Impact
Successful exploitation of these vulnerabilities can cause denial of service conditions in Squid proxy servers, disrupting proxy caching services for web clients. There are no known exploits in the wild at this time. The impact is limited to service availability degradation.
Mitigation Recommendations
Red Hat has released updated Squid packages for Red Hat Enterprise Linux 9.4 Extended Update Support that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:10255. No additional mitigation actions are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:10255
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-33526"]
- Cvss Version
- null
Threat ID: 6a160984e29bf47b50650867
Added to database: 05/26/2026, 20:58:44 UTC
Last enriched: 06/28/2026, 00:54:47 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.