CVE-2026-33515 in Web Proxy

Sumário (Inglês)

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Divulgação

26/03/2026

Estado

Confirmado

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
353116	Squid Web Proxy ICP Message Divulgação de Informação	125	Não definido	Correção oficial	CVE-2026-33515

Fontes

• MITRE
• NVD
• CVE Details