Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2026-07191

Опубликовано: 26 мар. 2026
Источник: fstec
CVSS3: 7.5
CVSS2: 7.8
EPSS Низкий

Описание

Уязвимость прокси-сервера Squid связана с неправильной блокировкой ресурсов. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Canonical Ltd.
ООО «Ред Софт»
Squid Software Foundation

Наименование ПО

Red Hat Enterprise Linux
Ubuntu
РЕД ОС
Squid

Версия ПО

6 (Red Hat Enterprise Linux)
8 (Red Hat Enterprise Linux)
22.04 LTS (Ubuntu)
9 (Red Hat Enterprise Linux)
24.04 LTS (Ubuntu)
9.0 Update Services for SAP Solutions (Red Hat Enterprise Linux)
7 Extended Lifecycle Support (Red Hat Enterprise Linux)
9.4 Extended Update Support (Red Hat Enterprise Linux)
10 (Red Hat Enterprise Linux)
9.2 Update Services for SAP Solutions (Red Hat Enterprise Linux)
25.10 (Ubuntu)
9.6 Extended Update Support (Red Hat Enterprise Linux)
8.0 (РЕД ОС)
10.0 Extended Update Support (Red Hat Enterprise Linux)
до 7.5 (Squid)

Тип ПО

Операционная система
Сетевое программное средство

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 6
Red Hat Inc. Red Hat Enterprise Linux 8
Canonical Ltd. Ubuntu 22.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 9
Canonical Ltd. Ubuntu 24.04 LTS
Red Hat Inc. Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Red Hat Inc. Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Inc. Red Hat Enterprise Linux 9.4 Extended Update Support
Red Hat Inc. Red Hat Enterprise Linux 10
Red Hat Inc. Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Canonical Ltd. Ubuntu 25.10
Red Hat Inc. Red Hat Enterprise Linux 9.6 Extended Update Support
ООО «Ред Софт» РЕД ОС 8.0
Red Hat Inc. Red Hat Enterprise Linux 10.0 Extended Update Support

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 7,8)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7,5)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://github.com/squid-cache/squid/security/advisories/GHSA-f9p7-3jqg-hhvq
Для РедОС:
https://redos.red-soft.ru/support/secure/uyazvimosti-red-os-8-0/uyazvimost-squid-cve-2026-32748-8.0/?sphrase_id=1505150
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2026-32748
Для Ubuntu:
https://ubuntu.com/security/CVE-2026-32748

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 95%
0.08931
Низкий

7.5 High

CVSS3

7.8 High

CVSS2

Связанные уязвимости

CVSS3: 7.5
ubuntu
4 месяца назад

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

CVSS3: 7.5
redhat
4 месяца назад

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

CVSS3: 7.5
nvd
4 месяца назад

Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.

CVSS3: 7.5
msrc
4 месяца назад

Squid has Denial of Service in ICP Response handling

CVSS3: 7.5
debian
4 месяца назад

Squid is a caching proxy for the Web. Prior to version 7.5, due to pre ...

EPSS

Процентиль: 95%
0.08931
Низкий

7.5 High

CVSS3

7.8 High

CVSS2