ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33515

Squid is a caching proxy for the Web.

Published Mar 26, 2026 · updated Jun 17, 2026 · squid-cache squid

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero ). This problem cannot be mitigated by denying ICP queries using rules. Version 7.5 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable

  2. Jun 17, 2026 · NIST NVD

    Updated

    Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable

Affected

  • cpe squid-cache/squidversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33515

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33515

    Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information

    nvd.nist.gov

References