{"id":"AZL-80768","summary":"CVE-2026-32748 affecting package squid for versions less than 6.13-4","details":"Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.","modified":"2026-08-30T05:26:50Z","published":"2026-03-26T01:16:26Z","upstream":["CVE-2026-32748"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32748"}],"affected":[{"package":{"name":"squid","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/squid"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-4"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-80768.json"}}],"schema_version":"1.9.0"}