Red Hat Product Security released an advisory (RHSA-2026:8317) for Squid 4 in Red Hat Enterprise Linux 8 addressing two denial of service vulnerabilities. CVE-2026-33526 is a heap use-after-free vulnerability in ICP handling, and CVE-2026-32748 is a denial of service triggered by crafted ICP traffic. These vulnerabilities affect the squid:4 module and related packages. The advisory rates the impact as important and provides updated packages to remediate the issues. No CVSS scores are provided in the advisory, but the severity is classified as high.

Successful exploitation of these vulnerabilities could cause denial of service conditions in the Squid proxy server, potentially disrupting proxy services that handle FTP and HTTP data objects. There is no indication of remote code execution or data disclosure. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for the squid:4 module in Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:8317 and the referenced update article (https://access.redhat.com/articles/11258). Since this is a traditional software package, remediation requires applying the vendor-provided update. Patch status is confirmed by the vendor advisory.