Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1786353802 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784801979 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785147682 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784801979 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1784986918 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.4 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1784713308 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1787042235 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1784730197 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 8.5 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1784987022 advisory.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6bbab8aa8 advisory.

    - new version 7.6

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4697 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4697-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 24, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : squid     Version        : 4.13-10+deb11u7 5.7-2+deb12u6     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729                      CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of     service.

    For Debian 11 bullseye, these problems have been fixed in version     4.13-10+deb11u7.

    For Debian 12 bookworm, these problems have been fixed in version     5.7-2+deb12u6.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1858 advisory.

    Due to an Improper Input Validation bug, Squid is vulnerable toa Heap-based Buffer Overflow attack against     cache digests.

    This problem allows a trusted server to perform a Heap-basedBuffer Overflow when sending maliciously     crafted replies tocache_digest request messages.

    This attack is limited to Squid instances that have beencompiled with the --enable-cache-digests option.
    (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3371 advisory.

    Due to an Improper Input Validation bug, Squid is vulnerable toa Heap-based Buffer Overflow attack against     cache digests.

    This problem allows a trusted server to perform a Heap-basedBuffer Overflow when sending maliciously     crafted replies tocache_digest request messages.

    This attack is limited to Squid instances that have beencompiled with the --enable-cache-digests option.
    (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6360 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6360-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 6.13-2+deb13u2.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Squid on the remote host is prior to 7.6. It is, therefore, affected by a heap-based buffer overflow vulnerability:

  - Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer Overflow attack against     cache digests. This problem allows a trusted server to perform a Heap-based Buffer Overflow when sending     maliciously crafted replies to cache_digest request messages. This attack is limited to Squid instances that     have been compiled with the --enable-cache-digests option. (CVE-2026-50012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8435-1 advisory.

    It was discovered that Squid incorrectly handled FTP gateway processing under certain circumstances, which     could result in an out-of-bounds read. A remote attacker could use this issue to cause Squid to crash,     resulting in a denial of service, or possibly obtain sensitive information. (CVE-2026-47729)

    It was discovered that Squid incorrectly handled cache digest processing under certain circumstances,     which could result in a heap-based buffer overflow. A remote attacker could use this issue to cause Squid     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache     digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based     buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the     digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can     trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests     option and configured with cache_peer entries. This issue is fixed in version 7.6. (CVE-2026-50012)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
362348	CentOS Linux 7 [TuxCare] Security Update: squid / squid-migration-script / squid-sysvinit Multiple Vulnerabilities (CENTOS7:CLSA-2026:1786353802)	Nessus	CentOS Local Security Checks	Local	medium
362330	Rocky Linux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784801979)	Nessus	Rocky Linux Local Security Checks	Local	medium
362063	AlmaLinux 9.2 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1785147682)	Nessus	Alma Linux Local Security Checks	Local	medium
361426	AlmaLinux 9.6 [TuxCare] Security Update: squid Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1784801979)	Nessus	Alma Linux Local Security Checks	Local	medium
360744	CentOS Linux 8 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1784986918)	Nessus	CentOS Local Security Checks	Local	medium
360446	CentOS Linux 8.4 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1784713308)	Nessus	CentOS Local Security Checks	Local	medium
359908	CentOS Linux 6 [TuxCare] Security Update: squid34 Multiple Vulnerabilities (CENTOS6:CLSA-2026:1787042235)	Nessus	CentOS Local Security Checks	Local	medium
353166	CentOS Linux 6 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS6:CLSA-2026:1784730197)	Nessus	CentOS Local Security Checks	Local	medium
352564	CentOS Linux 8.5 [TuxCare] Security Update: squid Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1784987022)	Nessus	CentOS Local Security Checks	Local	medium
330824	Fedora 44 : squid (2026-e6bbab8aa8)	Nessus	Fedora Local Security Checks	Local	medium
329264	Debian dla-4697 : squid - security update	Nessus	Debian Local Security Checks	Local	critical
322071	Amazon Linux 2023 : squid (ALAS2023-2026-1858)	Nessus	Amazon Linux Local Security Checks	Local	medium
322007	Amazon Linux 2 : squid, --advisory ALAS2-2026-3371 (ALAS-2026-3371)	Nessus	Amazon Linux Local Security Checks	Local	medium
321872	Debian dsa-6360 : squid - security update	Nessus	Debian Local Security Checks	Local	critical
321511	Squid < 7.6 Heap-based Buffer Overflow	Nessus	Firewalls	Remote	medium
321371	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Squid vulnerabilities (USN-8435-1)	Nessus	Ubuntu Local Security Checks	Local	critical
320883	Linux Distros Unpatched Vulnerability : CVE-2026-50012	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-50012

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

critical

medium

critical

medium