Version in base suite: 6.13-2+deb13u2 Base version: squid_6.13-2+deb13u2 Target version: squid_6.13-2+deb13u3 Base file: /srv/ftp-master.debian.org/ftp/pool/main/s/squid/squid_6.13-2+deb13u2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/s/squid/squid_6.13-2+deb13u3.dsc changelog | 6 + patches/CVE-2026-32748.patch | 146 +++++++++++++++++++++++++++++++++++++++++++ patches/series | 1 3 files changed, 153 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpkioj1jea/squid_6.13-2+deb13u2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpkioj1jea/squid_6.13-2+deb13u3.dsc: no acceptable signature found diff -Nru squid-6.13/debian/changelog squid-6.13/debian/changelog --- squid-6.13/debian/changelog 2026-06-19 15:54:19.000000000 +0000 +++ squid-6.13/debian/changelog 2026-09-03 20:51:56.000000000 +0000 @@ -1,3 +1,9 @@ +squid (6.13-2+deb13u3) trixie; urgency=medium + + * CVE-2026-33515 + + -- Moritz Mühlenhoff Thu, 03 Sep 2026 22:51:56 +0200 + squid (6.13-2+deb13u2) trixie-security; urgency=medium * CVE-2026-33515 diff -Nru squid-6.13/debian/patches/CVE-2026-32748.patch squid-6.13/debian/patches/CVE-2026-32748.patch --- squid-6.13/debian/patches/CVE-2026-32748.patch 1970-01-01 00:00:00.000000000 +0000 +++ squid-6.13/debian/patches/CVE-2026-32748.patch 2026-09-03 20:51:39.000000000 +0000 @@ -0,0 +1,146 @@ +From 703e07d25ca6fa11f52d20bf0bb879e22ab7481b Mon Sep 17 00:00:00 2001 +From: Alex Rousskov +Date: Wed, 18 Feb 2026 21:13:26 +0000 +Subject: [PATCH] ICP: Fix HttpRequest lifetime for ICP v3 queries (#2377) + +--- squid-6.13.orig/src/ICP.h ++++ squid-6.13/src/ICP.h +@@ -94,10 +94,7 @@ extern Ip::Address theIcpPublicHostID; + const char *icpGetUrl(const Ip::Address &from, const char *, const icp_common_t &); + + /// \ingroup ServerProtocolICPAPI +-HttpRequest *icpGetRequest(const char *url, int reqnum, int fd, const Ip::Address &from); +- +-/// \ingroup ServerProtocolICPAPI +-bool icpAccessAllowed(Ip::Address &from, HttpRequest * icp_request); ++HttpRequestPointer icpGetRequest(const char *url, int reqnum, int fd, const Ip::Address &from); + + /// \ingroup ServerProtocolICPAPI + void icpCreateAndSend(icp_opcode, int flags, char const *url, int reqnum, int pad, int fd, const Ip::Address &from, AccessLogEntryPointer); +--- squid-6.13.orig/src/icp_v2.cc ++++ squid-6.13/src/icp_v2.cc +@@ -440,8 +440,9 @@ icpDenyAccess(const Ip::Address &from, c + } + } + +-bool +-icpAccessAllowed(Ip::Address &from, HttpRequest * icp_request) ++/// icpGetRequest() helper that determines whether squid.conf allows the given ICP query ++static bool ++icpAccessAllowed(const Ip::Address &from, HttpRequest * icp_request) + { + /* absent any explicit rules, we deny all */ + if (!Config.accessList.icp) +@@ -486,7 +487,7 @@ icpGetUrl(const Ip::Address &from, const + return url; + } + +-HttpRequest * ++HttpRequest::Pointer + icpGetRequest(const char * const url, const int reqnum, const int fd, const Ip::Address &from) + { + if (strpbrk(url, w_space)) { +@@ -495,12 +496,17 @@ icpGetRequest(const char * const url, co + } + + const auto mx = MasterXaction::MakePortless(); +- auto *result = HttpRequest::FromUrlXXX(url, mx); +- if (!result) +- icpCreateAndSend(ICP_ERR, 0, url, reqnum, 0, fd, from, nullptr); ++ if (const HttpRequest::Pointer request = HttpRequest::FromUrlXXX(url, mx)) { ++ if (!icpAccessAllowed(from, request.getRaw())) { ++ icpDenyAccess(from, url, reqnum, fd); ++ return nullptr; ++ } + +- return result; ++ return request; ++ } + ++ icpCreateAndSend(ICP_ERR, 0, url, reqnum, 0, fd, from, nullptr); ++ return nullptr; + } + + static void +@@ -516,18 +522,11 @@ doV2Query(const int fd, Ip::Address &fro + return; + } + +- HttpRequest *icp_request = icpGetRequest(url, header.reqnum, fd, from); ++ const auto icp_request = icpGetRequest(url, header.reqnum, fd, from); + + if (!icp_request) + return; + +- HTTPMSGLOCK(icp_request); +- +- if (!icpAccessAllowed(from, icp_request)) { +- icpDenyAccess(from, url, header.reqnum, fd); +- HTTPMSGUNLOCK(icp_request); +- return; +- } + #if USE_ICMP + if (header.flags & ICP_FLAG_SRC_RTT) { + rtt = netdbHostRtt(icp_request->url.host()); +@@ -540,7 +539,7 @@ doV2Query(const int fd, Ip::Address &fro + #endif /* USE_ICMP */ + + /* The peer is allowed to use this cache */ +- ICP2State state(header, icp_request); ++ ICP2State state(header, icp_request.getRaw()); + state.fd = fd; + state.from = from; + state.url = xstrdup(url); +@@ -569,8 +568,6 @@ doV2Query(const int fd, Ip::Address &fro + } + + icpCreateAndSend(codeToSend, flags, url, header.reqnum, src_rtt, fd, from, state.al); +- +- HTTPMSGUNLOCK(icp_request); + } + + void +--- squid-6.13.orig/src/icp_v3.cc ++++ squid-6.13/src/icp_v3.cc +@@ -40,19 +40,13 @@ doV3Query(int fd, Ip::Address &from, con + return; + } + +- HttpRequest *icp_request = icpGetRequest(url, header.reqnum, fd, from); ++ const auto icp_request = icpGetRequest(url, header.reqnum, fd, from); + + if (!icp_request) + return; + +- if (!icpAccessAllowed(from, icp_request)) { +- icpDenyAccess (from, url, header.reqnum, fd); +- delete icp_request; +- return; +- } +- + /* The peer is allowed to use this cache */ +- ICP3State state(header, icp_request); ++ ICP3State state(header, icp_request.getRaw()); + state.fd = fd; + state.from = from; + state.url = xstrdup(url); +--- squid-6.13.orig/src/tests/stub_icp.cc ++++ squid-6.13/src/tests/stub_icp.cc +@@ -9,6 +9,7 @@ + #include "squid.h" + #include "AccessLogEntry.h" + #include "comm/Connection.h" ++#include "HttpRequest.h" + #include "ICP.h" + + #define STUB_API "icp_*.cc" +@@ -30,8 +31,7 @@ Comm::ConnectionPointer icpOutgoingConn; + Ip::Address theIcpPublicHostID; + + const char *icpGetUrl(const Ip::Address &, const char *, const icp_common_t &) STUB_RETVAL(nullptr) +-HttpRequest* icpGetRequest(const char *, int, int, const Ip::Address &) STUB_RETVAL(nullptr) +-bool icpAccessAllowed(Ip::Address &, HttpRequest *) STUB_RETVAL(false) ++HttpRequest::Pointer icpGetRequest(const char *, int, int, const Ip::Address &) STUB_RETVAL(nullptr) + void icpCreateAndSend(icp_opcode, int, char const *, int, int, int, const Ip::Address &, AccessLogEntryPointer) STUB + icp_opcode icpGetCommonOpcode() STUB_RETVAL(ICP_INVALID) + void icpDenyAccess(const Ip::Address &, const char *, int, int) STUB diff -Nru squid-6.13/debian/patches/series squid-6.13/debian/patches/series --- squid-6.13/debian/patches/series 2026-06-19 14:06:29.000000000 +0000 +++ squid-6.13/debian/patches/series 2026-09-03 20:51:24.000000000 +0000 @@ -8,3 +8,4 @@ CVE-2026-33526.patch CVE-2026-47729.patch CVE-2026-50012.patch +CVE-2026-32748.patch