Description
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq
X_Refsource_Misc x_refsource_misc
https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab7481b
Scores
CVSS v3
7.5
EPSS
0.0273
EPSS Percentile
84.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-413
CWE-416
CWE-826
Status
published
Products (1)
squid-cache/squid
< 7.5 (2 CPE variants)
Published
Mar 26, 2026
Tracked Since
Mar 26, 2026