Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol.
This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Squid-Cache Squid
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*
|
— |
7.5
|
References 3
https://github.com/squid-cache/squid/commit/703e07d25ca6fa11f52d20bf0bb879e22ab…
security-advisories@github.com
https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq
security-advisories@github.com
http://www.openwall.com/lists/oss-security/2026/03/25/3
af854a3a-2127-422b-91ae-364da2661108