Red Hat Product Security has released an advisory (RHSA-2026:11901) addressing two denial of service vulnerabilities in Squid. The first (CVE-2026-33526) is a heap use-after-free vulnerability in ICP handling, and the second (CVE-2026-32748) involves denial of service via crafted ICP traffic. These vulnerabilities affect Squid versions included in Red Hat Enterprise Linux 10.0 Extended Update Support across multiple architectures (x86_64, s390x, ppc64le, aarch64). The advisory provides updated Squid packages (version 6.10-5.el10_0.2) to remediate these issues. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported.

Successful exploitation of these vulnerabilities could cause denial of service conditions in the Squid proxy server, potentially disrupting proxy services. The issues stem from improper handling of ICP traffic, including a use-after-free condition that may lead to application crashes or instability.

Red Hat has released updated Squid packages (version 6.10-5.el10_0.2) for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply these official updates as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. No additional mitigation steps are indicated or required beyond applying the provided patches.