Skip to content
Sign in
CVE-2026-477296.5MediumCWE-125

Squid: Memory disclosure in FTP gateway

squid-cache · squid

Not in CISA KEV
1.5%probability of exploitation in the next 30 days
74th percentile
050100

Higher than 74% of scored CVEs

6.5MediumCVSS 3.1
LowMedium

DescriptionNVD

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Coverage4 articles · 3 outlets

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 13 Jun.

Full timeline
Quiet for 18 weekslast report 24 Jun4 articles3 outlets
13 Jun · SecurityOnline first23 Aug16 Sep10 OctNow
  • Sat 13 Jun, 04:18 UTC. SecurityOnline, first report. Critical Squid Proxy Vulnerabilities Patched in Latest Release.
  • Mon 22 Jun, 14:01 UTC. SecurityWeek, its first report on the story. Squidbleed bug leaks HTTP data via FTP flaw (CVE-2026-47729).
  • Tue 23 Jun, 08:33 UTC. Security Affairs, its first report on the story. Squidbleed flaw leaks user data via memory leak in proxy.
  • Wed 24 Jun, 02:01 UTC. SecurityOnline. Squid Proxy Flaw Exposes User Logins via FTP Parser Bug.
All coveragerunning total4SecurityOnl…2SecurityWeek1Security Af…113 Jun30 Jul15 SepNow
  • First report
  • Article
  • Running total
Show as table
4 articles about CVE-2026-47729 from 3 outlets
Published (UTC)OutletHeadline
13 Jun 04:18SecurityOnlineCritical Squid Proxy Vulnerabilities Patched in Latest Release
22 Jun 14:01SecurityWeekSquidbleed bug leaks HTTP data via FTP flaw (CVE-2026-47729)
23 Jun 08:33Security AffairsSquidbleed flaw leaks user data via memory leak in proxy
24 Jun 02:01SecurityOnlineSquid Proxy Flaw Exposes User Logins via FTP Parser Bug
  1. Squid Proxy Flaw Exposes User Logins via FTP Parser Bug
    SecurityOnline
  2. Squidbleed flaw leaks user data via memory leak in proxy
    Security Affairs
  3. Squidbleed bug leaks HTTP data via FTP flaw (CVE-2026-47729)
    SecurityWeek
  4. Critical Squid Proxy Vulnerabilities Patched in Latest Release
    SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in