oss-security - Re: [ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling (CVE-2026-33526)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260328023834.GA15295@openwall.com>
Date: Sat, 28 Mar 2026 03:38:34 +0100
From: Solar Designer <solar@...nwall.com>
To: Amos Jeffries <squid3@...enet.co.nz>
Cc: oss-security@...ts.openwall.com
Subject: Re: [ADVISORY] SQUID-2026:1 Denial of Service in ICP Request handling (CVE-2026-33526)

Hi Amos,

Thank you for bringing these 3 issues/advisories to oss-security.

On Wed, Mar 25, 2026 at 05:20:11PM +1300, Amos Jeffries wrote:
>  Due to a heap Use-After-Free bug Squid is vulnerable to Denial
>  of Service when handling ICP traffic.

Since use-after-free bugs commonly allow for impact not limited to DoS,
but often also code execution and/or information leak, it would help if
you provide justification why you claim this is just a DoS - or add
wording that it may be more than just a DoS.  Ditto for SQUID-2026:2
(CVE-2026-32748).

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.