Out-of-Bounds Read Vulnerability in Squid Caching Proxy
CVE-2026-47729

6.5MEDIUM

Key Information:

Vendor

Squid-cache

Status
Squid
Vendor
CVE Published:
16 July 2026

Badges

📰 News Worthy

What is CVE-2026-47729?

The Squid Caching Proxy has a vulnerability that results from improper validation of input syntax in its FTP gateway. Specifically, prior to version 7.6, when accessing FTP directory listings, if a date entry was not followed by a filename, the system failed to restrict parsing to the input buffer. This flaw can allow a trusted client interfacing with a compromised FTP server through the Squid gateway to read arbitrary memory from unrelated transactions, potentially exposing sensitive data. Version 7.6 resolves this issue.

Affected Version(s)

squid < 7.6

News Articles

favicon imageBetanews

Squidbleed proxy flaw found with AI assistance

AI-assisted research uncovered Squidbleed, a Squid proxy FTP gateway flaw that can expose cleartext HTTP data from shared proxy traffic.

favicon imageSwapupdate

29-Year-Old Squid Proxy Bug ‘Squidbleed’ Can Leak Cleartext HTTP Requests

Swati KhandelwalJun 22, 2026Vulnerability / Server Security

favicon imageThe Hacker News

29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests

Squidbleed CVE-2026-47729 can expose cleartext HTTP credentials from users sharing the same Squid proxy.

References

https://github.com/squid-cache/squid/security/advisories/...
x_refsource_CONFIRM
https://github.com/squid-cache/squid/pull/2408
x_refsource_MISC
https://github.com/squid-cache/squid/pull/2409
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 📰

    First article discovered by The Hacker News

  • Vulnerability Reserved

.