Listen to this Post
CVE-2026-50012 is a critical heap-based buffer overflow vulnerability in the Squid caching proxy, stemming from improper input validation within the cache digest reply handling mechanism. The flaw resides in the `peerDigestSwapInMask` function inside src/peer_digest.cc. Squid uses cache digests to efficiently exchange summary information about cached objects with trusted peer proxies. When a peer responds to a `cache_digest` request, Squid processes the incoming digest data and copies it into a heap-allocated buffer (pd->cd->mask). The size of this buffer is determined by a `mask_size` field declared within the digest itself.
The vulnerability arises because the on-the-wire size of the cache digest payload can be larger than the `mask_size` value advertised in the digest header. A malicious trusted peer can craft a reply where the actual data length exceeds the expected buffer size. During the `peerDigestSwapInMask` function, the code copies the incoming data into the fixed-size heap buffer without sufficient validation, leading to a classic heap-based buffer overflow. This allows the attacker to overwrite adjacent heap metadata or other heap-resident objects, potentially leading to memory corruption, denial of service, or arbitrary code execution.
This attack is only possible when Squid is compiled with the `–enable-cache-digests` option and configured with at least one `cache_peer` entry. The peer must be trusted and able to exchange cache digest messages over TCP. While the attack requires a trusted peer relationship, the impact is severe because a compromised or malicious peer within the same administrative domain can trigger the overflow. The vulnerability affects all Squid versions from 3.x through 7.5. The issue was addressed in Squid 7.6, with upstream patches backported to various stable release branches. The CVSS v3 score is rated as Critical with a base score of 8.4, reflecting the high potential for confidentiality, integrity, and availability impact. The exploit complexity is considered high due to the need for a trusted peer and the difficulty of reliable exploitation, but the attack vector is network-based and requires no authentication.
DailyCVE Form:
Platform: Squid Proxy
Version: 3.x – 7.5
Vulnerability: Heap-based Buffer Overflow
Severity: Critical (CVSS 8.4)
date: 2026-07-16
Prediction: Patch available (Squid 7.6)
Analytics under What Undercode Say:
Check if Squid is compiled with cache-digests (vulnerable feature) squid -v | grep -q 'enable-cache-digests' && echo "Vulnerable feature enabled" Check if cache_peer is configured without 'no-digest' (exploitable) squid -k parse 2>&1 | grep -w cache_peer | grep -v no-digest Verify Squid version (vulnerable if < 7.6) squid -v | head -n1 | grep -Eo '[0-9]+.[0-9]+' Apply upstream patch (commit 19fcfe922717c8b255270c032dcde4071c003bcd) wget https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd.patch patch -p1 < 19fcfe922717c8b255270c032dcde4071c003bcd.patch make && make install Debian/Ubuntu: Check fixed package version apt-cache policy squid | grep -E 'Installed|Candidate' Fixed versions: 7.2-2ubuntu2.2 (Ubuntu 26.04), 6.13-2+deb13u2 (Debian trixie)
Exploit:
A remote attacker with control over a trusted `cache_peer` can send a specially crafted `cache_digest` reply. The reply contains a `mask_size` field that is smaller than the actual payload length. When Squid processes this reply, `peerDigestSwapInMask` copies the oversized payload into the heap buffer, overflowing adjacent memory. This can corrupt heap metadata, leading to a crash (denial of service) or, with careful manipulation, arbitrary code execution. The attack is launched over TCP, and the peer must be authenticated as a trusted entity. No user interaction is required.
Protection:
- Upgrade to Squid 7.6 or apply the official patch (commit
19fcfe922717c8b255270c032dcde4071c003bcd). - For users of older stable releases, backported patches are available (e.g., Debian
6.13-2+deb13u2, Ubuntu7.2-2ubuntu2.2). - Workaround: Add the `no-digest` option to all `cache_peer` directives in `squid.conf` to disable cache digest exchanges. This eliminates the attack surface at the cost of increased bandwidth usage.
- Restrict `cache_peer` relationships to only fully trusted servers within your administrative domain.
- Monitor Squid logs for anomalous cache digest exchanges or crashes.
Impact:
- Confidentiality: Potential information disclosure through memory corruption.
- Integrity: Possible modification of heap data, leading to unpredictable behavior.
- Availability: Denial of service via application crash or memory corruption.
- Scope: Affects all Squid instances compiled with `–enable-cache-digests` and using
cache_peer. The vulnerability is remotely exploitable over TCP by a trusted peer. The CVSS v3 score is 8.4 (Critical), indicating a high risk to affected deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
