CVE-2026-50012

Katalog CVE

CVSS 5.5 · Medium EPSS 2,7%

Kerentanan Improper Input Validation pada squid-cache squid. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

20 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-122: Heap-based Buffer Overflow

EPSS (30 hari)

2,7% peluang dieksploitasi; lebih tinggi dari 85,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284 advisory vendor
• https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd patch
• https://github.com/squid-cache/squid/pull/2423 patch
• https://github.com/squid-cache/squid/releases/tag/SQUID_7_6 release notes