Squidbleed Flaw Can Expose Users’ HTTP Data Through Squid Proxy
Summary
Calif researchers disclosed Squidbleed (CVE-2026-47729), a Squid FTP parser memory leak that may expose prior users’ HTTP request data. The article says Squid 7.6 includes a patch and disabling FTP can mitigate the risk.
Key points
- CVE-2026-47729 affects Squid’s FTP parser, which can read beyond a memory buffer into uncleared data from a previous user’s HTTP request.
- Exploitation requires control of an FTP server reachable from the proxy; shared Squid environments are at greater risk.
- Potentially exposed data may include credentials, session tokens, and API keys.
- The article says the exposure is limited to cleartext HTTP and deployments where Squid terminates TLS; HTTPS relayed through opaque CONNECT tunnels is not affected.
- A fix was merged into Squid version 8 in April 2026 and shipped in version 7.6 in June 2026; disabling FTP support is suggested as a mitigation.
- The researchers say they used Anthropic’s Claude Mythos AI model to help discover the vulnerability.
Article Details
- Vulnerability Types
- Out-of-bounds read
- Memory disclosure
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable FTP support if it is not needed.