CVE-2026-33515

A flaw was found in Squid, a caching proxy for the Web. Due to improper input validation, Squid is vulnerable to an out-of-bounds read when handling Internet Cache Protocol (ICP) traffic. A remote attacker can exploit this by sending invalid ICP requests, potentially receiving small amounts of memory containing sensitive information. This vulnerability is limited to Squid deployments that have explicitly enabled ICP support.

This flaw in Squid has Moderate impact. It is only exploitable in Red Hat products if Squid is configured to explicitly enable ICP support (i.e., icp_port is set to a non-zero value), which is not the default configuration. This issue cannot be mitigated by icp_access rules.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, ensure that Internet Cache Protocol (ICP) support is disabled in Squid. This can be achieved by setting icp_port to 0 or commenting out the icp_port directive in the squid.conf configuration file. After modifying the configuration, the Squid service must be restarted for the changes to take effect.