CVE-2026-32748 is a high-severity vulnerability in squid-cache's Squid proxy server affecting versions before 7.5. It involves improper resource locking and heap Use-After-Free conditions during ICP traffic processing, leading to a reliable and repeatable Denial of Service attack. The vulnerability specifically impacts Squid deployments with ICP support enabled (non-zero icp_port). Attempts to block ICP queries with icp_access rules do not mitigate this issue. Red Hat has issued advisories and patches addressing this vulnerability in their Extended Life Cycle Support releases, and the upstream fix is included in Squid 7.5.

A remote attacker can cause a Denial of Service on vulnerable Squid servers by sending crafted ICP traffic. This disrupts the availability of the Squid proxy service. The attack requires ICP support to be enabled and cannot be mitigated by access control rules that deny ICP queries. No known exploits are reported in the wild at this time.

This vulnerability is fixed in Squid version 7.5. Users should upgrade to version 7.5 or later to remediate the issue. For Red Hat Enterprise Linux Extended Life Cycle Support 7, updated squid packages addressing this vulnerability are available and should be applied. Since the vulnerability cannot be mitigated by denying ICP queries via icp_access rules, upgrading is the recommended remediation. Patch status is confirmed by Red Hat advisories RHSA-2026:8119 and RHSA-2026:8880.