CVE-2026-33526

Publication date 26 March 2026

Last updated 8 April 2026

Ubuntu priority

Description

Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
squid	25.10 questing	Fixed 6.14-0ubuntu0.25.10.2
	24.04 LTS noble	Fixed 6.14-0ubuntu0.24.04.2
	22.04 LTS jammy	Fixed 5.9-0ubuntu0.22.04.5
	20.04 LTS focal	Needs evaluation
squid3	25.10 questing	Not in release
	24.04 LTS noble	Not in release
	22.04 LTS jammy	Not in release
	18.04 LTS bionic	Needs evaluation
	16.04 LTS xenial	Needs evaluation

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
squid	Upstream: 8a7d42f

References

Related Ubuntu Security Notices (USN)

USN-8157-1
Squid vulnerabilities
8 April 2026