Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-32748 is a high-severity Improper Resource Locking (CWE-413) vulnerability in Squid-Cache Squid. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Squid, a widely deployed caching proxy for the Web, is affected by CVE-2026-32748 in all versions prior to 7.5. The root cause is a combination of premature resource release during the expected object lifetime and heap use-after-free conditions that manifest when the proxy processes ICP traffic. These memory-safety defects are tracked under CWE-413, CWE-416, and CWE-826 and produce a CVSS 4.0 score of 8.7 with high impact on availability.
A remote attacker who can send crafted ICP messages can trigger a reliable, repeatable denial-of-service condition against any Squid instance that has ICP support enabled via a non-zero icp_port setting. The attack succeeds even when icp_access rules are configured to restrict ICP queries, because the flaw occurs before access-control checks complete.
The official GitHub Security Advisory and the commit 703e07d25ca6fa11f52d20bf0bb879e22ab7481b confirm that the defects are resolved in Squid 7.5; operators are advised to upgrade rather than rely on network-level filtering. Mailing-list posts on oss-security reiterate that ICP must be disabled entirely if patching is delayed.
EPSS for the CVE rose sharply from a low baseline to a peak of 0.0180 on the disclosure date of 26 March 2026 before receding to its current value of 0.0021, indicating a transient but measurable increase in exploitation interest immediately after publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16056
Vulnerability Data
Squid is a caching proxy for the Web. Prior to version 7.5, due to premature release of resource during expected lifetime and heap Use-After-Free bugs, Squid is vulnerable to Denial of Service when handling ICP traffic. This problem allows a…
more
remote attacker to perform a reliable and repeatable Denial of Service attack against the Squid service using ICP protocol. This attack is limited to Squid deployments that explicitly enable ICP support (i.e. configure non-zero `icp_port`). This problem _cannot_ be mitigated by denying ICP queries using `icp_access` rules. This bug is fixed in Squid version 7.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 3 hardening rules · 3 OS baselines
V1.4.3
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover use-after-free bugs through dynamic analysis or fuzzing.
Engineering principles can require memory-safe constructs or languages that structurally avoid introducing use-after-free.
Process isolation confines the blast radius of use-after-free memory corruption to a single execution domain.
Memory protection controls limit exploitation impact by blocking unauthorized code execution from dangling pointers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (reviews, static analysis, coding standards) directly prevent improper locking defects from being introduced.
Vulnerability identification processes can discover use-after-free issues via scanning or analysis but do not prevent their introduction.
Routine patching removes known use-after-free instances after they have been introduced in released software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect locking defects but does not itself implement locking controls.
Secure development lifecycle requires proper resource management patterns that prevent improper locking.
Application security requirements can mandate exclusive-access controls and locking mechanisms.
Secure system architecture principles include concurrency and resource-locking design rules.
Secure coding standards directly prohibit missing or incorrect resource locks.
Change-management processes help ensure memory-safety fixes are deployed consistently.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. prevents CWE-416
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. prevents CWE-416
RHEL 9 (1 rule)
- V-257794 RHEL 9 must clear memory when it is freed to prevent use-after-free attacks. prevents CWE-416