Описание
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero icp_port). This problem cannot be mitigated by denying ICP queries using icp_access rules. This bug is fixed in Squid version 7.5.
A flaw was found in Squid. A remote attacker can exploit this vulnerability by sending specially crafted ICP (Internet Cache Protocol) traffic. This can lead to a Denial of Service (DoS) due to premature resource release and use-after-free vulnerabilities. This attack is possible in Squid deployments with explicitly enabled ICP support.
Отчет
This Important flaw in Squid can lead to a Denial of Service when processing specially crafted Internet Cache Protocol (ICP) traffic. This vulnerability affects Red Hat products running Squid if ICP support is explicitly enabled by configuring a non-zero icp_port. Deployments where ICP is not enabled by default are not affected.
Меры по смягчению последствий
To mitigate this issue, ensure that ICP support is not explicitly enabled in the Squid configuration. This can be achieved by commenting out or setting icp_port to 0 in the squid.conf file. After modifying the configuration, the Squid service must be reloaded or restarted for the changes to take effect.
Example:
or
Warning: Reloading or restarting the Squid service may temporarily interrupt proxy services.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | squid | Out of support scope | ||
| Red Hat Enterprise Linux 6 | squid34 | Out of support scope | ||
| Red Hat Enterprise Linux 10 | squid | Fixed | RHSA-2026:8119 | 14.04.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | squid | Fixed | RHSA-2026:11901 | 29.04.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | squid | Fixed | RHSA-2026:8880 | 20.04.2026 |
| Red Hat Enterprise Linux 8 | squid | Fixed | RHSA-2026:8317 | 15.04.2026 |
| Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | squid | Fixed | RHSA-2026:20564 | 26.05.2026 |
| Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | squid | Fixed | RHSA-2026:20564 | 26.05.2026 |
| Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | squid | Fixed | RHSA-2026:20565 | 26.05.2026 |
| Red Hat Enterprise Linux 8.6 Telecommunications Update Service | squid | Fixed | RHSA-2026:20565 | 26.05.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
Squid is a caching proxy for the Web. Prior to version 7.5, due to pre ...
Уязвимость прокси-сервера Squid, связанная с неправильной блокировкой ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
EPSS
7.5 High
CVSS3