CVE-2026-33515
Publication date 26 March 2026
Last updated 21 October 2026
Ubuntu priority
Description
Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| squid | 26.10 stonking |
Not affected
|
| 26.04 LTS resolute |
Not affected
|
|
| 24.04 LTS noble |
Fixed in 6.14-0ubuntu0.24.04.2
|
|
| 22.04 LTS jammy |
Fixed in 5.9-0ubuntu0.22.04.5
|
|
| 20.04 LTS focal |
Fixed in 4.10-1ubuntu1.13+esm3
|
|
| squid3 | 26.10 stonking | Not in release |
| 26.04 LTS resolute | Not in release | |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 18.04 LTS bionic |
Fixed in 3.5.27-1ubuntu1.14+esm6
|
|
| 16.04 LTS xenial |
Fixed in 3.5.12-1ubuntu7.16+esm7
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version:
Base score
6.9 · Medium
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N
Base score
6.5 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-8157-1
- Squid vulnerabilities
- 8 April 2026
- USN-8941-1
- Squid vulnerabilities
- 20 October 2026