Medium severity6.5OSV Advisory· Published Jul 16, 2026· Updated Jul 20, 2026
CVE-2026-47729
CVE-2026-47729
Description
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
Affected products
4SQUID_7_5, SQUID_7_4, SQUID_7_3, …+ 2 more
- (no CPE)range: SQUID_7_5, SQUID_7_4, SQUID_7_3, …
- cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*range: <7.6
- (no CPE)range: <7.6
Patches
Vulnerability mechanics
References
5- github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8nvdPatch
- github.com/squid-cache/squid/pull/2408nvdPatch
- github.com/squid-cache/squid/pull/2409nvdPatch
- github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrgnvdVendor Advisory
- github.com/squid-cache/squid/releases/tag/SQUID_7_6nvdRelease Notes
News mentions
5- ⚡ Weekly Recap: Linux Kernel Flaws, AI Malware Tricks, Turla Backdoor, Infostealers and MoreThe Hacker News · Jun 29, 2026
- Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton eraThe Register Security · Jun 23, 2026
- OpenAI Expands Daybreak With GPT-5.5-Cyber to Help Defenders Patch Security FlawsThe Hacker News · Jun 23, 2026
- 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP RequestsThe Hacker News · Jun 22, 2026
- Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User DataSecurityWeek · Jun 22, 2026