{"id":"DEBIAN-CVE-2026-50012","details":"Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.","modified":"2026-09-14T17:03:17.006771959Z","published":"2026-07-16T17:16:57.493Z","upstream":["CVE-2026-50012"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-50012"}],"affected":[{"package":{"name":"squid","ecosystem":"Debian:12","purl":"pkg:deb/debian/squid?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7-2+deb12u6"}]}],"versions":["5.7-2","5.7-2+deb12u1","5.7-2+deb12u2","5.7-2+deb12u3","5.7-2+deb12u4","5.7-2+deb12u5"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50012.json"}},{"package":{"name":"squid","ecosystem":"Debian:13","purl":"pkg:deb/debian/squid?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-2+deb13u2"}]}],"versions":["6.13-2","6.13-2+deb13u1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50012.json"}},{"package":{"name":"squid","ecosystem":"Debian:14","purl":"pkg:deb/debian/squid?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6-1"}]}],"versions":["6.13-2","7.1-1","7.2-1","7.2-2","7.4-1","7.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-50012.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H"}]}