CVE-2026-47729

CVE Enrichment

CVSS: 6.5 MEDIUM
EPSS: 1.50%
EPSS Percentile: 74.26%
CISA KEV: Not listed

Description

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 17-Jul-2026 00:16
Last Modified: 25-Oct-2026 03:10
EPSS Date: 2026-10-29
CWE: CWE-125, CWE-1289

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:N /
                            A:N

Affected Products / Versions

squid-cache / squid Source: NVD CPE · affected
Version / affected range: * · before (exclusive) 7.6
cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*

References

Last enrichment sync: 30-Oct-2026 16:28
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Case in point is a 29-year-old flaw in the Squid web proxy (CVE-2026-47729, aka Squidbleed) that can leak cleartext HTTP requests belonging to other users under certain conditions. OpenAI Expands GPT-5.5-Cyber and Launches Open-Source Security Initiative
A heap over-read in Squid, dubbed Squidbleed (CVE-2026-47729), can leak another user’s cleartext HTTP requests, including credentials or session tokens, to any trusted client already allowed to use the same proxy. Squidbleed Bug Can Leak Cleartext HTTP Requests from Squid Proxy Users
Officially tracked as CVE-2026-47729, the vulnerability causes Squid’s FTP parser to read beyond the boundary of a memory buffer, into a region that may contain a previous user’s uncleared HTTP request data. Squidbleed Flaw Can Expose Users’ HTTP Data Through Squid Proxy

People (2)

MITRE ATT&CK (1)

Vendors (3)

Products (4)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.