{"id":"CLSA-2026-1774947465","summary":"Fix CVE(s): CVE-2026-32748, CVE-2026-33515, CVE-2026-33526","details":"   * SECURITY UPDATE: Denial of Service in ICP request handling via double\n     rfc1738_escape() call causing heap use-after-free\n     - debian/patches/CVE-2026-33526.patch: Remove redundant rfc1738_escape()\n       call in icpGetRequest()\n     - CVE-2026-33526\n   * SECURITY UPDATE: Denial of Service in ICP v3 query handling via\n     use-after-free of HttpRequest object\n     - debian/patches/CVE-2026-32748.patch: Add proper HTTPMSGLOCK/HTTPMSGUNLOCK\n       to doV3Query() to match doV2Query() locking pattern\n     - CVE-2026-32748\n   * SECURITY UPDATE: Out-of-bounds read in ICP message handling allows\n     information disclosure\n     - debian/patches/CVE-2026-33515.patch: Add icpGetUrl() validation function\n       to check packet bounds and NUL-termination of URLs in ICP messages\n     - CVE-2026-33515","modified":"2026-06-04T09:45:32.131012698Z","published":"2026-03-31T08:57:50Z","upstream":["CVE-2026-32748","CVE-2026-33515","CVE-2026-33526"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1774947465.html"}],"affected":[{"package":{"name":"squid","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squid?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}},{"package":{"name":"squid-cgi","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squid-cgi?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}},{"package":{"name":"squid-common","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squid-common?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}},{"package":{"name":"squid-purge","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squid-purge?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}},{"package":{"name":"squid3","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squid3?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}},{"package":{"name":"squidclient","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/squidclient?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6-1+deb10u10+tuxcare.els4"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1774947465.json"}}],"schema_version":"1.7.5"}