Red Hat Product Security has released an important security update for the squid:4 module in Red Hat Enterprise Linux 8.6 to address two denial of service vulnerabilities. CVE-2026-33526 is a heap Use-After-Free vulnerability in the ICP handling code of Squid, which can lead to denial of service. CVE-2026-32748 is a denial of service vulnerability triggered by crafted ICP traffic. These issues affect multiple Red Hat Enterprise Linux 8.6 AppStream variants. The advisory references Red Hat Bugzilla entries and provides updated packages to remediate these vulnerabilities. No CVSS base scores are included in the advisory, and no known exploits have been reported.

Successful exploitation of these vulnerabilities could cause denial of service conditions in Squid proxy servers running on affected Red Hat Enterprise Linux 8.6 systems. This could disrupt proxy services and impact availability. There is no indication of privilege escalation, data disclosure, or code execution. No known exploits in the wild have been reported at this time.

Red Hat has released updated packages for the squid:4 module in Red Hat Enterprise Linux 8.6 that address these vulnerabilities. Users should apply the security update as detailed in Red Hat advisory RHSA-2026:20565 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. Patch status is confirmed as an official fix available from Red Hat. No additional mitigation steps are indicated by the vendor.