{"id":"AZL-80762","summary":"CVE-2026-33526 affecting package squid for versions less than 6.13-4","details":"Squid is a caching proxy for the Web. Prior to version 7.5, due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.","modified":"2026-08-30T05:26:50Z","published":"2026-03-26T01:16:27Z","upstream":["CVE-2026-33526"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33526"}],"affected":[{"package":{"name":"squid","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/squid"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80762.json"}}],"schema_version":"1.9.0"}