CVE-2026-32748

The record

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

Affected packages

Related vulnerabilities

• CVE-2026-44608 NLnet Labs Unbound 1.14.0 up to and including version 1.25.0 has a locking inconsistency… CWE-413
• GHSA-jw2v-cq5x-q68g Pterodactyl improperly locks resources allowing raced queries to create more resources… CWE-413
• CVE-2025-69198 Pterodactyl is a free, open-source game server management panel. CWE-413
• CVE-2025-0003 Inadequate lock protection within Xilinx Run time may allow a local attacker to trigger a… CWE-413
• CVE-2023-33951 A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. CWE-413
• CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-416
• CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-416
• CVE-2026-112402 Pillow is a Python imaging library. CWE-416