Squid Caching Proxy Alert: Critical ICP Protocol Flaws Threaten Web Infrastructure

Squid's Internet Cache Protocol (ICP) implementation contains multiple serious vulnerabilities — two heap Use-After-Free bugs enabling reliable remote Denial of Service and a memory-disclosure flaw (CVE-2026-33515, CVSS 6.9) that can leak internal proxy memory. The issues affect Squid versions 3.0 through 7.4 when ICP is enabled (non-zero icp_port); they cannot be mitigated by icp_access rules. The vendor released fixes in Squid 7.5 and backported commits for the stable 7 branch; immediate mitigation is to disable ICP or set icp_port to 0 until patched.