CVE-2026-50012

Name	CVE-2026-50012
Description	Squid is a caching proxy for the Web. Prior to 7.6, due to an improper input validation bug in cache digest reply handling (peerDigestSwapInMask in src/peer_digest.cc), Squid is vulnerable to a heap-based buffer overflow: a cache digest's on-the-wire size may be larger than the mask_size declared within the digest, so a trusted peer sending a maliciously crafted reply to a cache_digest request message can trigger the overflow. This attack is limited to Squid instances compiled with the --enable-cache-digests option and configured with cache_peer entries. This issue is fixed in version 7.6.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-6360-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
squid (PTS)	bullseye	4.13-10+deb11u3	vulnerable
	bullseye (security)	4.13-10+deb11u6	vulnerable
	bookworm	5.7-2+deb12u5	vulnerable
	bookworm (security)	5.7-2+deb12u4	vulnerable
	trixie (security), trixie	6.13-2+deb13u2	fixed
	forky, sid	7.6-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
squid	source	trixie	6.13-2+deb13u2		DSA-6360-1
squid	source	(unstable)	7.6-1

Notes

https://www.openwall.com/lists/oss-security/2026/06/12/1
Fixed by: https://github.com/squid-cache/squid/commit/19fcfe922717c8b255270c032dcde4071c003bcd (SQUID_7_6)
Follow-up: https://github.com/squid-cache/squid/commit/c9c9a06be6fb21f400014dcb0ec7e6d573167a5d (SQUID_7_6)
https://github.com/squid-cache/squid/security/advisories/GHSA-5vmx-9x64-9284