Squidbleed Bug Can Leak Cleartext HTTP Requests from Squid Proxy Users

Summary

Squidbleed (CVE-2026-47729), a heap over-read in Squid’s FTP listing parser, can expose other users’ cleartext HTTP requests to a client already authorized to use the same proxy. Fixes include a parser guard or disabling FTP; no in-the-wild exploitation was reported.

Key points

An attacker must already be allowed to use the same Squid proxy and direct it to an FTP server they control; FTP and port 21 are enabled by default.
A malformed FTP directory-listing line can make the parser read past a buffer and return the excess bytes as a filename.
Reused heap memory may expose another proxy user’s cleartext HTTP request, including credentials or session tokens.
The leak affects traffic Squid can read, such as cleartext HTTP or traffic decrypted by TLS-terminating inspection; ordinary HTTPS CONNECT traffic is opaque to Squid.
The fix adds a null-terminator check in the FTP parser. Disabling FTP is another mitigation; administrators are advised to verify the patch or distribution backport.
The article reports conflicting statements about whether Squid 7.6 or 7.7 contains the fix, while noting a Debian maintainer said the referenced commit may already be in 7.6.
Public proof-of-concept code exists, but no in-the-wild exploitation had been reported as of the article.