Red Hat Product Security has released an important security update for Squid, a high-performance proxy caching server, addressing two denial of service vulnerabilities involving ICP traffic. The first vulnerability (CVE-2026-33526) is a heap use-after-free issue in ICP handling, and the second (CVE-2026-32748) involves denial of service via crafted ICP traffic. These vulnerabilities affect Red Hat Enterprise Linux 9.0 and related packages across various architectures including x86_64, ppc64le, aarch64, and s390x. The advisory provides updated Squid packages to remediate these issues. No known exploits in the wild have been reported. The vendor advisory confirms the availability of fixes and directs users to apply the updated packages.

Successful exploitation of these vulnerabilities could cause denial of service conditions in Squid proxy servers by triggering heap use-after-free or by sending crafted ICP traffic. This could disrupt proxy services and impact availability. There is no indication of code execution or data compromise from the provided information. No known exploits in the wild have been reported at this time.

Red Hat has released updated Squid packages addressing these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.0 systems should apply the security update described in advisory RHSA-2026:10256 promptly to remediate these issues. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation depends on applying the vendor-provided patches. No additional mitigation steps are indicated by the vendor advisory.