Critical Denial of Service Vulnerability in Squid Proxy Server
Summary
ALSA-2026:8317: Important: squid:4 security update. Affects libecap across 2 version ranges.
< 1.0.1-2.module_el8.6.0+2741+01592ae8
< 1.0.1-2.module_el8.6.0+3048+383bc947
Fixed in 1.0.1-2.module_el8.6.0+2741+01592ae8 or 1.0.1-2.module_el8.6.0+3048+383bc947, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Squid is a high-performance proxy caching server widely used for web clients, supporting various protocols including FTP and HTTP. It is designed to improve web performance by caching frequently accessed content and reducing bandwidth usage. However, recent vulnerabilities have been identified that could compromise its stability and security.
Vulnerability Detail
The vulnerabilities identified in Squid include a Denial of Service (DoS) via a heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) and another DoS via crafted ICP traffic (CVE-2026-32748). These vulnerabilities can be exploited by sending specially crafted ICP messages, leading to potential service interruptions and degraded performance of the proxy server.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libecap-
< 1.0.1-2.module_el8.6.0+2741+01592ae81.0.1-2.module_el8.6.0+2741+01592ae8 -
< 1.0.1-2.module_el8.6.0+3048+383bc9471.0.1-2.module_el8.6.0+3048+383bc947
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can limit access to the Squid server by configuring firewall rules to restrict incoming ICP traffic. This can help mitigate the risk of exploitation until the package is updated.
Conclusion
The identified vulnerabilities in the Squid proxy server pose significant risks that can lead to Denial of Service attacks. It is crucial for users to update their installations to the patched version to ensure continued security and performance. Utilizing tools like Vulert can help in monitoring for such vulnerabilities effectively.
See every vulnerability recorded for libecap →
FAQ
The vulnerabilities are related to Denial of Service attacks that can be triggered by malformed ICP messages.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to install any additional tools.
Failure to address these vulnerabilities may lead to service interruptions, degraded performance, and potential exploitation by malicious actors.
Yes, you can configure your package manager to automatically check for and apply updates to ensure that you are always running the latest version.
Detailed information can be found on the CVE pages referenced in the advisory, which provide insights into the vulnerabilities and their impacts.
Related vulnerabilities
Recent vulnerabilities recorded for libecap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
