Red Hat Product Security has published an advisory (RHSA-2026:10257) addressing two denial of service vulnerabilities in Squid. The first (CVE-2026-33526) is a heap use-after-free vulnerability in ICP handling, and the second (CVE-2026-32748) involves denial of service via crafted ICP traffic. These vulnerabilities affect Squid versions as included in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions and Extended Life Cycle variants. The advisory provides updated Squid packages (version 5.5-5.el9_2.11) to remediate these issues. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.

Successful exploitation of these vulnerabilities could cause denial of service conditions in Squid proxy servers by triggering heap use-after-free or by sending specially crafted ICP traffic. This may result in service disruption for web clients relying on the proxy caching server. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated Squid packages that fix these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.2 versions and related distributions should apply the security update as described in the advisory (RHSA-2026:10257) and the referenced update article (https://access.redhat.com/articles/11258). No additional mitigation steps are indicated by the vendor.