Red Hat Product Security has published an advisory for two denial of service vulnerabilities in Squid, a high-performance proxy caching server. The first vulnerability (CVE-2026-33526) is a heap use-after-free issue in ICP handling, and the second (CVE-2026-32748) involves denial of service via crafted ICP traffic. Both vulnerabilities could cause service disruption. The advisory covers Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. Updated Squid packages are available from Red Hat to remediate these vulnerabilities. The advisory does not provide CVSS scores but rates the impact as Important. No evidence of exploitation in the wild is currently known.

Successful exploitation of these vulnerabilities could result in denial of service conditions on affected Squid proxy servers, potentially disrupting web and FTP caching services. There is no indication of remote code execution or data compromise. No known active exploitation has been reported.

Red Hat has released updated Squid packages for Red Hat Enterprise Linux 10.0 Extended Update Support to address these vulnerabilities. Users should apply the available security updates as detailed in the Red Hat advisory (RHSA-2026:11901) and the referenced update article (https://access.redhat.com/articles/11258). Patch status is confirmed by the vendor advisory as an official fix. No additional mitigation steps are indicated by Red Hat.