CVE-2026-32748

A flaw was found in Squid. A remote attacker can exploit this vulnerability by sending specially crafted ICP (Internet Cache Protocol) traffic. This can lead to a Denial of Service (DoS) due to premature resource release and use-after-free vulnerabilities. This attack is possible in Squid deployments with explicitly enabled ICP support.

This Important flaw in Squid can lead to a Denial of Service when processing specially crafted Internet Cache Protocol (ICP) traffic. This vulnerability affects Red Hat products running Squid if ICP support is explicitly enabled by configuring a non-zero icp_port. Deployments where ICP is not enabled by default are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that ICP support is not explicitly enabled in the Squid configuration. This can be achieved by commenting out or setting icp_port to 0 in the squid.conf file. After modifying the configuration, the Squid service must be reloaded or restarted for the changes to take effect.

Example:

# icp_port 3130

or

icp_port 0

Warning: Reloading or restarting the Squid service may temporarily interrupt proxy services.