Red Hat Security Advisory: squid:4 security update
Red Hat has issued a security advisory for the squid:4 module in Red Hat Enterprise Linux 8.6 variants addressing two denial of service vulnerabilities. These vulnerabilities involve a heap use-after-free in ICP handling (CVE-2026-33526) and denial of service via crafted ICP traffic (CVE-2026-32748). The advisory rates the impact as Important and provides updated packages to remediate the issues. The vulnerabilities affect the squid proxy caching server component used in Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. No CVSS score is provided in the advisory. The vendor has released updated packages to fix these issues.
AI Analysis
Technical Summary
This advisory addresses two denial of service vulnerabilities in the squid:4 proxy caching server module as shipped with Red Hat Enterprise Linux 8.6 variants. CVE-2026-33526 is a heap use-after-free vulnerability in ICP (Internet Cache Protocol) handling, and CVE-2026-32748 involves denial of service triggered by crafted ICP traffic. Both vulnerabilities could allow an attacker to cause the squid service to crash or become unavailable. Red Hat has released updated squid:4 packages for affected RHEL 8.6 variants to remediate these issues. The advisory does not provide CVSS scores but rates the update as Important. No known exploits in the wild are reported at this time.
Potential Impact
Successful exploitation of these vulnerabilities could cause a denial of service condition in the squid proxy service by triggering heap use-after-free or by sending crafted ICP traffic. This would result in service disruption or crash of the squid proxy server, potentially impacting web caching and proxy operations on affected Red Hat Enterprise Linux 8.6 systems.
Mitigation Recommendations
Red Hat has released updated squid:4 packages for Red Hat Enterprise Linux 8.6 variants that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20565 to remediate the issues. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as fixed by the vendor advisory.
Red Hat Security Advisory: squid:4 security update
Description
Red Hat has issued a security advisory for the squid:4 module in Red Hat Enterprise Linux 8.6 variants addressing two denial of service vulnerabilities. These vulnerabilities involve a heap use-after-free in ICP handling (CVE-2026-33526) and denial of service via crafted ICP traffic (CVE-2026-32748). The advisory rates the impact as Important and provides updated packages to remediate the issues. The vulnerabilities affect the squid proxy caching server component used in Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Update Services for SAP Solutions, and Telecommunications Update Service. No CVSS score is provided in the advisory. The vendor has released updated packages to fix these issues.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory addresses two denial of service vulnerabilities in the squid:4 proxy caching server module as shipped with Red Hat Enterprise Linux 8.6 variants. CVE-2026-33526 is a heap use-after-free vulnerability in ICP (Internet Cache Protocol) handling, and CVE-2026-32748 involves denial of service triggered by crafted ICP traffic. Both vulnerabilities could allow an attacker to cause the squid service to crash or become unavailable. Red Hat has released updated squid:4 packages for affected RHEL 8.6 variants to remediate these issues. The advisory does not provide CVSS scores but rates the update as Important. No known exploits in the wild are reported at this time.
Potential Impact
Successful exploitation of these vulnerabilities could cause a denial of service condition in the squid proxy service by triggering heap use-after-free or by sending crafted ICP traffic. This would result in service disruption or crash of the squid proxy server, potentially impacting web caching and proxy operations on affected Red Hat Enterprise Linux 8.6 systems.
Mitigation Recommendations
Red Hat has released updated squid:4 packages for Red Hat Enterprise Linux 8.6 variants that fix these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:20565 to remediate the issues. No additional mitigation steps are indicated by the vendor. Patch status is confirmed as fixed by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:20565
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-33526"]
- Cvss Version
- null
Threat ID: 6a160980e29bf47b5064ca4b
Added to database: 05/26/2026, 20:58:40 UTC
Last enriched: 06/28/2026, 00:20:25 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 40
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.