Squid through 4.14 and 5.x through 5.0.5 in some configurations allows information disclosure because of an out-of-bounds read in WCCP protocol data. This can be leveraged as part of a chain for remote code execution as nobody.