Squid: Memory corruption in cache_digest reply handling
CVE-2026-50012 is fixed in 9 products on 1 platform, first by squid 7.2-2ubuntu2.2, released June 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| squid · Debian 12.15 (bookworm) | 5.7-2+deb12u6 | DEBIAN-CVE-2026-50012 | Jun 24, 2026 |
| squid · Debian 13.5 (trixie) | 6.13-2+deb13u2 | DEBIAN-CVE-2026-50012 | Jun 24, 2026 |
| squid · Debian 14 | 7.6-1 | DEBIAN-CVE-2026-50012 | Jun 24, 2026 |
| squid · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid · amzn 2023 | 7:6.13-1.amzn2023.0.5 | ALAS2023-2026-1858 | Jun 22, 2026 |
| squid · opensuse-leap 16.0 | 6.14-160000.1.1 | OPENSUSE-SU-2026:22080-1 | Nov 7, 2026 |
| squid · sles 15.6 | 6.14-150600.3.20.1 | SUSE-SU-2026:4621-1 | Nov 7, 2026 |
| squid · sles 15.7 | 6.14-150600.3.20.1 | SUSE-SU-2026:4621-1 | Nov 7, 2026 |
| squid · sles 16.0 | 6.14-160000.1.1 | SUSE-SU-2026:24224-1 | Nov 7, 2026 |
| squid-cgi · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-cgi 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-cgi · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-cgi 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-cgi · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-cgi 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-cgi · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-cgi 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-cgi · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-cgi 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-common · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-common 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-common · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-common 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-common · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-common 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-common · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-common 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-common · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-common 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-common · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid-common 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid-debuginfo · amzn 2023 | 7:6.13-1.amzn2023.0.5 | ALAS2023-2026-1858 | Jun 22, 2026 |
| squid-debugsource · amzn 2023 | 7:6.13-1.amzn2023.0.5 | ALAS2023-2026-1858 | Jun 22, 2026 |
| squid-openssl · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-openssl 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-openssl · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-openssl 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-openssl · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-openssl 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-openssl · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid-openssl 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid-purge · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-purge 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-purge · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-purge 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-purge · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-purge 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-purge · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-purge 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-purge · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-purge 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid3 · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid3 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squidclient · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squidclient 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squidclient · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squidclient 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squidclient · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squidclient 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squidclient · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squidclient 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squidclient · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squidclient 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.