df165bd9a4
via crafted ICP traffic (CVE-2026-32748) Resolves: RHEL-160674 - squid:4/squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)
19 lines
548 B
Diff
19 lines
548 B
Diff
commit 476f48d4c482e9e0e5ba457ad35175f70e71562b
|
|
Author: Tomas Korbar <tkorbar@redhat.com>
|
|
Date: Tue Apr 7 16:18:09 2026 +0200
|
|
|
|
Fix CVE-2026-33526
|
|
|
|
diff --git a/src/icp_v2.cc b/src/icp_v2.cc
|
|
index 8d03bde..eb63899 100644
|
|
--- a/src/icp_v2.cc
|
|
+++ b/src/icp_v2.cc
|
|
@@ -435,7 +435,6 @@ HttpRequest *
|
|
icpGetRequest(char *url, int reqnum, int fd, Ip::Address &from)
|
|
{
|
|
if (strpbrk(url, w_space)) {
|
|
- url = rfc1738_escape(url);
|
|
icpCreateAndSend(ICP_ERR, 0, rfc1738_escape(url), reqnum, 0, fd, from);
|
|
return NULL;
|
|
}
|