Debian Linux - squid - None

Ubuntu Linux - Heap-based Buffer Overflow attack against cache digests

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1858 advisory.

    Due to an Improper Input Validation bug, Squid is vulnerable toa Heap-based Buffer Overflow attack against     cache digests.

    This problem allows a trusted server to perform a Heap-basedBuffer Overflow when sending maliciously     crafted replies tocache_digest request messages.

    This attack is limited to Squid instances that have beencompiled with the --enable-cache-digests option.
    (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of squid installed on the remote host is prior to 3.5.20-17. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3371 advisory.

    Due to an Improper Input Validation bug, Squid is vulnerable toa Heap-based Buffer Overflow attack against     cache digests.

    This problem allows a trusted server to perform a Heap-basedBuffer Overflow when sending maliciously     crafted replies tocache_digest request messages.

    This attack is limited to Squid instances that have beencompiled with the --enable-cache-digests option.
    (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6360 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6360-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 6.13-2+deb13u2.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Squid on the remote host is prior to 7.6. It is, therefore, affected by a heap-based buffer overflow vulnerability:

  - Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer Overflow attack against     cache digests. This problem allows a trusted server to perform a Heap-based Buffer Overflow when sending     maliciously crafted replies to cache_digest request messages. This attack is limited to Squid instances that     have been compiled with the --enable-cache-digests option. (CVE-2026-50012)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8435-1 advisory.

    It was discovered that Squid incorrectly handled FTP gateway processing under certain circumstances, which     could result in an out-of-bounds read. A remote attacker could use this issue to cause Squid to crash,     resulting in a denial of service, or possibly obtain sensitive information. (CVE-2026-47729)

    It was discovered that Squid incorrectly handled cache digest processing under certain circumstances,     which could result in a heap-based buffer overflow. A remote attacker could use this issue to cause Squid     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - squid - None  Ubuntu Linux - Heap-based Buffer Overflow attack against cache digests     (CVE-2026-50012)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
322071	Amazon Linux 2023 : squid (ALAS2023-2026-1858)	Nessus	Amazon Linux Local Security Checks	critical
322007	Amazon Linux 2 : squid, --advisory ALAS2-2026-3371 (ALAS-2026-3371)	Nessus	Amazon Linux Local Security Checks	critical
321872	Debian dsa-6360 : squid - security update	Nessus	Debian Local Security Checks	critical
321511	Squid < 7.6 Heap-based Buffer Overflow	Nessus	Firewalls	critical
321371	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Squid vulnerabilities (USN-8435-1)	Nessus	Ubuntu Local Security Checks	critical
320883	Linux Distros Unpatched Vulnerability : CVE-2026-50012	Nessus	Misc.	high

Detections

Analytics

CVE-2026-50012

critical

Tenable Plugins

critical

critical

critical

critical

critical

high