Zero Radar
← feed
HighVulnerabilityupdated 27 Oct 2026, 12:19 UTC

Squid proxy: several flaws allow denial of service

Squid is a widely used web proxy server. Attackers on the internet can exploit several bugs in it to crash or overload the server, so people using it can no longer get web access through it.

Official source
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Remote attackerSends crafted requests over the internet
  2. 2Internet trafficRequests reach the exposed proxy
  3. 3Squid proxyVulnerable code mishandles the requests
  4. 4Service stopsProxy becomes unresponsive for users
  5. ResultProxy service becomes unavailable

What happened

Multiple vulnerabilities in the Squid caching proxy allow a remote, unauthenticated attacker to cause a denial-of-service condition.

Why it is dangerous: A successful attack takes the proxy offline, disrupting web access for every user and system that depends on it.

Are you affected?

You are affected if you run a Squid proxy server; the affected versions are not specified in the available material.

What to do

  1. Check which Squid version you run and compare it against the vendor advisory
  2. Update Squid to the fixed version listed in the official advisory
  3. Restrict access to the proxy to trusted networks until patched

Timeline

  1. 27 Oct 2026, 12:16 UTC
    Publicly disclosed
  2. 27 Oct 2026, 12:16 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  3. 27 Oct 2026, 12:16 UTC
    Reported by CERT-Bund (BSI) · CERT-Bund (BSI)
  4. 27 Oct 2026, 12:18 UTC
    Picked up by Zero Radar

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
ZR-c260c04d · ZR-3f61582f
Disclosed
27 Oct 2026, 12:16 UTC
On Zero Radar
27 Oct 2026, 12:18 UTC (2 min after disclosure)
Last change
27 Oct 2026, 12:19 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Squid proxy: several flaws allow denial of service · Zero Radar