CVE-2026-33526

The vulnerability results from a memory management error (CWE-416: Use-After-Free, CWE-826) in the ICP protocol handling module. When processing ICP packets, Squid references a heap memory area that has already been previously freed, leading to process instability and crash. An attacker can repeatedly send specially crafted ICP requests, triggering the same effect each time. It is important to note that applying access control rules `icp_access` does not protect against exploitation of this vulnerability — the error occurs at an earlier processing stage.

A remote, unauthenticated attacker can cause permanent and reproducible unavailability of the Squid service (Denial of Service), resulting in the inability for users and dependent systems to use the proxy server.

Squid should be updated to version 7.5, which contains the appropriate patch. If updating is not immediately possible, risk can be reduced by disabling ICP support (setting `icp_port 0` in the configuration) — however, it should be remembered that `icp_access` rules alone do not provide effective protection.

Squid versions prior to 7.5, with the vulnerability affecting only deployments where ICP protocol support has been explicitly enabled by setting a non-zero value for the `icp_port` parameter.