THE Squid proxy project has released version 7.6 which patches two vulnerabilities tracked as CVE-2026-47729 and CVE-2026-50012. The flaws expose HTTP request data, including usernames and passwords, in environments where the proxy handles FTP directory listings. Shared networks that rely on Squid for web filtering are particularly at risk because a single compromised FTP server could leak information from many users. Administrators should treat the update as urgent given the potential for credential theft across large user bases. The release notes are available on the Squid GitHub release page.
CVE-2026-47729, nicknamed Squidbleed, is an out-of-bounds read in the FTP directory-listing parser. A missing filename after a modification timestamp causes the code to read past the end of a buffer, leaking memory contents from previous HTTP transactions. This can reveal session cookies, authentication headers and even plaintext passwords when the proxy forwards unencrypted traffic. The issue has been present since 1997 and carries a CVSS score of 6.5. Details were first published by Calif.io on their blog.
CVE-2026-50012 is a heap-based buffer overflow that can be triggered by crafted FTP responses. Successful exploitation may allow an attacker to execute arbitrary code on the proxy host with the privileges of the Squid process. In some configurations the flaw also leads to a denial of service, crashing the daemon and disrupting web access for all users. While a CVSS score has not been released, the vendor rates the issue as critical. The same Squid 7.6 release contains the necessary fix.
No active exploitation or threat actor has been attributed to these bugs, but the long lifespan of the vulnerabilities means any outdated proxy is a potential entry point. Researchers discovered the memory leak with the help of AI models, which sped up analysis of decades-old code. The flaw is most dangerous in networks where Squid terminates TLS and forwards cleartext HTTP to backend servers.
Environments such as hotels, universities or corporate guest networks often run Squid in exactly this mode, increasing the chance of data leakage. Chaining the flaw with weak outbound firewall rules could let an attacker pivot from a compromised FTP server to the internal proxy.
Defenders should upgrade to Squid 7.6 as soon as possible and apply the vendor-provided patches. If FTP functionality is not required, disabling the ftp_proxy option in squid.conf provides an immediate mitigation. Additionally, enforce end-to-end TLS for all upstream connections and monitor proxy logs for unexpected outbound FTP traffic or spikes in memory usage. Administrators can also lock down ACLs to prevent CONNECT to FTP ports unless explicitly needed, reducing the attack surface. Enabling core dumps on a test system after patching helps verify that the memory leak no longer triggers abnormal termination.
Finally, maintain an accurate inventory of all proxy instances, test the update in a staging environment before rollout, and schedule regular vulnerability scans to catch any regressions. Subscribing to the Squid security mailing list ensures timely notice of future issues. Keeping the software current remains the most effective way to protect user credentials and session tokens from exposure.