Red Hat Product Security has released an important security advisory (RHSA-2026:20580) for Squid 4.15 on Red Hat Enterprise Linux 8.8 addressing two denial of service vulnerabilities. CVE-2026-33526 is a heap use-after-free vulnerability in ICP handling, and CVE-2026-32748 involves denial of service via crafted ICP traffic. Both vulnerabilities can cause service disruption. The advisory provides updated packages to remediate these issues. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported. The update applies to multiple Red Hat Enterprise Linux 8.8 variants including Update Services for SAP Solutions and Telecommunications Update Service.

The vulnerabilities allow denial of service conditions in Squid proxy servers by exploiting ICP protocol handling flaws. This can result in service interruption or crash of the Squid process, impacting availability. There are no reports of exploitation in the wild. The impact is limited to denial of service, with no indication of privilege escalation or data compromise.

Red Hat has released updated Squid packages for Red Hat Enterprise Linux 8.8 that address these vulnerabilities. Users should apply the official security update as detailed in Red Hat advisory RHSA-2026:20580 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as an official fix available from Red Hat.