CVE-2026-33515

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33515
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33515.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33515
Aliases
  • GHSA-84p4-hcx7-jj7c
Downstream
Published
2026-03-26T00:13:51.127Z
Modified
2026-08-12T16:25:00.589028Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N CVSS Calculator
Summary
Squid has issues in ICP message handling
Details

Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. Version 7.5 contains a patch.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125",
        "CWE-1289"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33515.json"
}
References

Affected packages

Git / github.com/squid-cache/squid

Affected ranges

Type
GIT
Repo
https://github.com/squid-cache/squid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2e58fa81c730f29f6ec52ef8bd056e658e01d50c
Fixed
8138e909d2058d4401e0ad49b583afaec912b165
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*"
}

Affected versions

4.*
4.15-20210522-snapshot
4.15-20210523-snapshot
4.15-20210524-snapshot
4.15-20210525-snapshot
4.15-20210527-snapshot
5.*
5.0.6-20210522-snapshot
5.0.6-20210523-snapshot
5.0.6-20210524-snapshot
5.0.6-20210525-snapshot
5.0.6-20210527-snapshot
6.*
6.0.0-20210522-master-snapshot
6.0.0-20210523-master-snapshot
6.0.0-20210524-master-snapshot
6.0.0-20210525-master-snapshot
6.0.0-20210527-master-snapshot
Other
HISTORIC_RELEASES
M-staged-PR161
M-staged-PR164
M-staged-PR170
M-staged-PR176
M-staged-PR179
M-staged-PR181
M-staged-PR182
M-staged-PR186
M-staged-PR189
M-staged-PR193
M-staged-PR195
M-staged-PR196
M-staged-PR198
M-staged-PR199
M-staged-PR200
M-staged-PR202
M-staged-PR206
M-staged-PR208
M-staged-PR209
M-staged-PR210
M-staged-PR218
M-staged-PR220
M-staged-PR221
M-staged-PR225
M-staged-PR227
M-staged-PR229
M-staged-PR230
M-staged-PR235
M-staged-PR237
M-staged-PR238
M-staged-PR239
M-staged-PR241
M-staged-PR242
M-staged-PR252
M-staged-PR255
M-staged-PR258
M-staged-PR264
M-staged-PR266
M-staged-PR267
M-staged-PR268
M-staged-PR274
M-staged-PR276
M-staged-PR293
M-staged-PR294
M-staged-PR295
M-staged-PR299
M-staged-PR306
M-staged-PR314
M-staged-PR319
M-staged-PR342
M-staged-PR345
M-staged-PR348
M-staged-PR351
M-staged-PR359
M-staged-PR364
M-staged-PR365
M-staged-PR366
M-staged-PR370
M-staged-PR372
M-staged-PR373
M-staged-PR375
M-staged-PR376
SQUID_3_0_PRE1
SQUID_3_0_PRE2
SQUID_3_0_PRE3
SQUID_3_0_PRE4
SQUID_3_0_PRE5
SQUID_3_0_PRE6
SQUID_3_0_PRE7
SQUID_3_0_RC1
SQUID_3_5_27
SQUID_4_0_1
SQUID_4_0_10
SQUID_4_0_11
SQUID_4_0_12
SQUID_4_0_13
SQUID_4_0_14
SQUID_4_0_15
SQUID_4_0_16
SQUID_4_0_2
SQUID_4_0_3
SQUID_4_0_4
SQUID_4_0_5
SQUID_4_0_6
SQUID_4_0_7
SQUID_4_0_8
SQUID_4_0_9
SQUID_7_0_1
SQUID_7_0_2
SQUID_7_1
SQUID_7_2
SQUID_7_3
SQUID_7_4
take00

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33515.json"
vanir_signatures 
[
    {
        "target": {
            "file": "src/tests/stub_icp.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-0024c5ee",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "165055993165950869659440456318747296553",
                "197428339015130204807675357532811853648",
                "76540452186774299881598547811160779663",
                "122376884202641665254497819455435343026",
                "286820736784359204957760908754470975255",
                "115498185857354087938461465382705275075",
                "272407456338185288230984342298063939300",
                "337569762748072579569256442131645713741"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "doV2Query",
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-30dce935",
        "signature_version": "v1",
        "digest": {
            "length": 1382.0,
            "function_hash": "293872597637969632462316624952529265526"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/icp_v3.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-863178eb",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "305251779780306330643977263324912018843",
                "67129550549867931079452347693952028013",
                "108447099506442687114393483075530060496",
                "153448415009864155716949147104571583168",
                "339160150213332893092129794162738779827",
                "241122634747460210339136453697057053021"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "icpDenyAccess",
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-967b8f5a",
        "signature_version": "v1",
        "digest": {
            "length": 270.0,
            "function_hash": "23814674674325393737960045400221542709"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "icpGetRequest",
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-a91b3817",
        "signature_version": "v1",
        "digest": {
            "length": 460.0,
            "function_hash": "148802332562900817102942162056355544256"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "file": "src/ICP.h"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-afec0cd6",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "274265555125875022636698174409195732685",
                "268716178360173202096586163332889527250",
                "264561110873299654722212950033085259471",
                "139435363048678869214716904340501241788",
                "156294346217383823772155757274639183555",
                "334896002555061544269706375552088881277",
                "184171625406700548355325951336917596982",
                "298699242046751120020626390284408638468"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-b77d603e",
        "signature_version": "v1",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "31834653081568628594976710324139014272",
                "52613106617778028937073395151850574839",
                "326367942600290254051887671913817106870",
                "11211739863097779572894259953202806831",
                "334234212337295629201561292588292016845",
                "306429927353564579202688733084799443607",
                "97493569724149201717703319404230470797",
                "219565574705579764023263750966362487325",
                "317308419435950366122217696554268963216",
                "14730136902615328482666874661902165671",
                "137967017190731855472082732604067111757",
                "299115626936843168201269315369808237639",
                "87682355206797595213536797827664730440",
                "50609276091343272921035731045209840505",
                "319557957732592498244597911742667056590",
                "218570874415226329592231992007117505911",
                "178825447668851995332150011591263190469",
                "241122634747460210339136453697057053021",
                "186612026525701540777345277963969782087",
                "267331923784895459601894992648177543985",
                "289295224891650912640093914814274381566",
                "76409655953906516649505293286578270663",
                "2493659098436472948587900199163419210",
                "229265544599204696155949667315751226504",
                "81927608677262739622797673985150253029",
                "37017406588747205773749695216627393147"
            ]
        },
        "signature_type": "Line"
    },
    {
        "target": {
            "function": "icp_common_t::handleReply",
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-c10c8850",
        "signature_version": "v1",
        "digest": {
            "length": 595.0,
            "function_hash": "164453295655370803852845663917579394573"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "doV3Query",
            "file": "src/icp_v3.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-f90f3dc0",
        "signature_version": "v1",
        "digest": {
            "length": 664.0,
            "function_hash": "72246228506829905815987016900556722560"
        },
        "signature_type": "Function"
    },
    {
        "target": {
            "function": "icpHandleUdp",
            "file": "src/icp_v2.cc"
        },
        "deprecated": false,
        "source": "https://github.com/squid-cache/squid/commit/8138e909d2058d4401e0ad49b583afaec912b165",
        "id": "CVE-2026-33515-fbb9bfda",
        "signature_version": "v1",
        "digest": {
            "length": 1380.0,
            "function_hash": "100092720983235103532957945255321012079"
        },
        "signature_type": "Function"
    }
]
vanir_signatures_modified 
"2026-08-12T16:25:00Z"