Red Hat Product Security has published an advisory (RHSA-2026:10256) addressing two denial of service vulnerabilities in Squid. The first (CVE-2026-33526) is a heap use-after-free vulnerability in ICP handling, and the second (CVE-2026-32748) involves denial of service via crafted ICP traffic. Both vulnerabilities affect Squid versions distributed with Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. The advisory provides updated packages (squid-5.2-1.el9_0.10) for multiple architectures including x86_64, ppc64le, aarch64, and s390x. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat. No known exploits in the wild have been reported at this time.

Successful exploitation of these vulnerabilities could cause denial of service conditions in the Squid proxy server, potentially disrupting proxy services. The heap use-after-free vulnerability could lead to instability or crashes when handling ICP traffic. The crafted ICP traffic vulnerability similarly allows denial of service by sending malicious ICP packets. There is no indication of code execution or data disclosure impacts.

Red Hat has released updated Squid packages (version 5.2-1.el9_0.10) for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions to address these vulnerabilities. Users should apply these updates promptly following Red Hat's published guidance at https://access.redhat.com/articles/11258. No additional mitigations are indicated or required beyond applying the official patches.