Squid, the Web caching proxy, suffers from a heap use‑after‑free error that can be triggered by crafted ICP (Internet Cache Protocol) requests. A remote attacker able to reach the ICP service can cause the Squid process to crash, resulting in a reliable denial of service. The flaw is a memory safety defect and therefore a high‑severity issue.

Products affected are Squid caching proxy versions earlier than 7.5. The vulnerability applies only to configurations that have ICP enabled, i.e., a non‑zero icp_port value. No other products or vendor versions are reported as affected.

The CVSS score of 9.2 indicates critical severity, while the EPSS score of 2 % suggests a relatively low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. An attacker with network reach to the ICP port can exploit the flaw; local privileges are not required. Successful exploitation results in a service crash and downtime until a restart.