Squidbleed a heap failure in Squid that exposes clear text credentials in shared proxies CVE-2026-47729

A heap overreadture failure in the Squid proxy - nicknamed Squidbleed (CVE-2026-47729) - can filter to an attacker clear text information from the HTTP requests of other users of the same proxy, including Autorization headers or session tokens. Unlike vulnerabilities that allow access from any host on the Internet, here the attacker should already be authorized to use the proxy: it is the classic threat of a malicious trust client in shared networks such as universities, offices or public Wi-Fi.

The origin of the bug is a subtlety in the FTP list parseum inherited from the 1990s: a loop that jumps spaces depends on the strchr function without checking whether it has reached the final NUL character of the chain. If an attacker-controlled FTP server sends a truncated line that ends just after the time mark and does not include file name, the code walks out of the buffer and copies adjacent bytes released, which in practice contain parts of other HTTP requests that Squid left in memory. Since Squid does not clean the buffers before reusing them, the result may be clear credentials.

It is important to understand the scope: only HTTP requests are at risk in clear text (or traffic that Squid intentionally deciphers). The CONNECT tunnel used by standard HTTPS keeps the session opaque for Squid, so the encrypted content is not affected. However, many networks still allow FTP and Port 21 are usually default active in Squid, which facilitates the operating vector if an internal attacker offers a malformed FTP server.

The upstream correction consists of adding an explicit check of the NUL terminator before calling strchr in FtpGateway.cc; the patch reached development branches and the v7 series in spring, although the public maintenance threads showed some inconsistency on which versions actually contain the arrangement. That's why. not enough to update by version: check the patch applied to your binary or distribution package.

Recommended emergency actions for network administrators and safety equipment: apply patches published by your supplier and confirm that the correction affects FtpGateway.cc (or the equivalent commitment if its distribution backportes changes). If you cannot park immediately, disable the management of FTP in Squid; it is the cleanest mitigation and the one recommended by researchers, since many environments no longer use FTP actively. In addition, consider blocking the outgoing traffic to port 21 at the network gateway to reduce the risk.

After patching or disabling FTP, check your environment: rote credentials and tokens exposed if you suspect engagement, check proxy records for unusual internal FTP connections and search for logs that indicate short FTP server responses or traffic to FTP server controlled by internal hosts. If your deployment uses TLS interception (TLS termination in Squid), take into account that this traffic is at risk and should be monitored with priority.

For equipment that depends on third party packages, check the status in its distribution: some maintainers publish backloaded patches and notes on security trackers. You can consult the public register of the CVE on official sources and the Squid project page for the follow-up of launches and advices; useful examples are the NVD tab of the CVE and the Squid project site: https: / / nvd.nist.gov / vuln / detail / CVE-2026-47729 and https: / / www.squid-cache.org /. For Debian / Ubuntu distributions, the security tracker usually shows the status of packages and backports: https: / / security-tracker.debian.org / tracker / CVE-2026-47729.

This incidence also illustrates two useful trends for defenders: first, historical code chains and parsers written for ancient protocols remain prolific sources of memory failure; second, analysis tools assisted by automated models and agents are helping to detect subtle patterns - in this case, researchers quote that an IA model helped identify strchr peculiarity -, making these tools valuable supplements for legacy code security audits.

In short, the risk is real but narrow: it requires access to the proxy and the ability to direct the proxy to a malformed FTP server. However, the practical recommendation is clear and of low cost: disable FTP in Squid if you do not need it and confirm that your installation incorporates the NIL terminator check in FtpGateway.cc. Where there is doubt about the correction, treat the incident as if there had been critical exposure and rote credentials.