Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to receive small amounts of memory potentially containing sensitive information when responding with errors to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using `icp_access` rules. Version 7.5 contains a patch.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8157-1 advisory.

    It was discovered that Squid incorrectly handled certain ICP traffic. In environments where ICP support is     enabled, a remote attacker could use this issue to cause Squid to crash, resulting in a denial of service,     or obtain small amounts of sensitive information.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Squid on the remote host is prior to 7.5. It is, therefore, affected by multiple vulnerabilities:

  - Due to heap Use-After-Free, Squid is vulnerable to Denial of Service when handling ICP traffic. This attack is     limited to Squid deployments that explicitly enable ICP support. (CVE-2026-33526)

  - Due to improper input validation, Squid is vulnerable to out of bounds read when handling ICP traffic. This     allows a remote attacker to receive small amounts of memory potentially containing sensitive information.
    (CVE-2026-33515)

  - Due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable     to Denial of Service when handling ICP traffic. (CVE-2026-32748)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. Prior to version 7.5, due to improper input validation, Squid is     vulnerable to out of bounds read when handling ICP traffic. This problem allows a remote attacker to     receive small amounts of memory potentially containing sensitive information when responding with errors     to invalid ICP requests. This attack is limited to Squid deployments that explicitly enable ICP support     (i.e. configure non-zero `icp_port`). This problem cannot be mitigated by denying ICP queries using     `icp_access` rules. Version 7.5 contains a patch. (CVE-2026-33515)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
306089	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : Squid vulnerabilities (USN-8157-1)	Nessus	Ubuntu Local Security Checks	critical
303933	Squid < 7.5 Multiple Vulnerabilities	Nessus	Firewalls	critical
303662	Linux Distros Unpatched Vulnerability : CVE-2026-33515	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-33515

medium

Tenable Plugins

critical

critical

medium