Squidbleed CVE-2026-47729: 29-Year Squid Proxy Bug Leaks HTTP Credentials

Researchers disclosed a critical heap over-read vulnerability in Squid Proxy that has existed since 1997. CVE-2026-47729, nicknamed Squidbleed, lets a trusted attacker on the same proxy leak another user’s cleartext HTTP requests. Consequently, passwords, session tokens, and API keys can be exposed without any special configuration required.

What Happened: Squidbleed Leaks User HTTP Requests via 29-Year-Old FTP Bug

On June 10, 2026, Calif Security Research published details of CVE-2026-47729, a heap buffer overread in the Squid web proxy’s FTP directory-listing parser. Furthermore, the bug traces back to a January 1997 commit intended to handle extra whitespace from NetWare FTP servers. Therefore, the flaw survived nearly three decades of releases and audits.

The vulnerability is Heartbleed-style: an attacker on the same proxy sends an FTP directory-listing request to a malicious server they control. The malformed response triggers an overread that leaks memory from Squid’s heap. Moreover, because the leaked buffer previously held other users’ HTTP requests, sensitive data such as Authorization headers, cookies, and session tokens can be returned to the attacker.

HTTPS traffic is mostly unaffected because Squid forwards it through opaque CONNECT tunnels. However, cleartext HTTP and TLS-terminating proxy setups remain exposed. In addition, no special flags are needed to exploit the bug: FTP support is enabled by default, and TCP port 21 is allowed in the default Safe_ports ACL.

Technical Details of the Squidbleed Vulnerability

The flaw resides in Squid’s FTP gateway (src/clients/FtpGateway.cc). When parsing an FTP LIST response, the parser uses strchr to skip whitespace before extracting a filename. If no filename follows the timestamp, *copyFrom points to the null terminator. In C11, strchr treats the null terminator as part of the string and returns a pointer to it instead of NULL. As a result, the loop increments copyFrom beyond the buffer boundary, causing a heap overread.

Squid uses per-size freelists on top of malloc. When a 4KB buffer is freed, it is pushed onto the MEM_4K_BUF freelist without being zeroed. The next allocation of the same size pops that buffer intact. On Squid 7.x, most HTTP requests are stored in MEM_4K_BUF. Thus, an attacker who triggers the overread can recover stale HTTP request data left in the reused buffer.

Attack requirements:

• The attacker must be a trusted client already permitted to use the proxy.
• The attacker must control an FTP server reachable from the proxy on TCP port 21.
• The targeted traffic must be cleartext HTTP (or TLS-terminating proxy traffic).
• FTP support must be enabled (default).

Memory Allocator Behavior That Enables the Leak

On Squid 7.x, the client request buffer size is 4096 bytes and is allocated from MEM_4K_BUF. The short FTP listing line overwrites only the first few dozen bytes, leaving the rest of the buffer filled with a previous user’s HTTP request data. Therefore, the overread walks past the null terminator and sends the attacker everything that remains in the buffer.

Versions Affected

• Squid 7.x and earlier versions are affected.
• The bug exists in default configurations going back to 1997.
• Squid 7.6 (released June 8, 2026) contains the fix.
• Squid 7.7 is the recommended patched version.

Business and Operational Impact

Squid is widely deployed in schools, corporate networks, ISPs, and in-flight WiFi systems. Because the vulnerability requires only local proxy access and a reachable FTP server, the attack surface is broad in shared networks. Moreover, legacy systems running older Squid builds are especially at risk.

• Credential exposure: HTTP Authorization headers, session cookies, and API keys can leak to an attacker.
• Session hijacking: Stolen tokens can be reused to impersonate users.
• Data breach risk: Internal applications, admin panels, and APIs served over HTTP are at risk.
• Compliance implications: Exposure of authentication secrets may trigger incident-response and notification obligations under GDPR, CCPA, and sector-specific rules.
• Operational overhead: Organizations must audit proxy logs, rotate credentials, and verify patch coverage.

Mitigation and Recommendations

Organizations running Squid proxies should act immediately to reduce exposure. The simplest and most effective mitigation is to disable FTP support unless it is explicitly required.

Immediate Actions for Defenders

1. Disable FTP support. Add ftp_passive off or block outbound FTP (TCP 21) at the firewall. Most environments no longer need FTP because modern browsers have dropped FTP support.
2. Upgrade to Squid 7.7 or later. The patch adds a null-terminator check before the strchr loop.
3. Inspect proxy configurations. Review Safe_ports ACLs to ensure unnecessary outbound ports are blocked.
4. Monitor for suspicious FTP requests. Look for proxy logs showing FTP directory-listing requests to uncommon or external FTP servers.
5. Rotate credentials and sessions. If cleartext HTTP traffic traversed an affected proxy, rotate passwords and invalidate active sessions.

Long-Term Hardening

• Remove or disable unused Squid features to reduce attack surface.
• Prefer HTTPS for all internal and external services.
• Segment proxy users where possible to limit cross-user memory exposure.
• Schedule periodic security audits of legacy code paths in critical infrastructure.

Bottom line: A one-character logic bug in 1997-era FTP parsing code now exposes cleartext credentials on shared Squid proxies. Disable FTP, patch to Squid 7.7, and audit your proxy deployments today.

Incident Summary

CVE ID / Incident:	CVE-2026-47729 (Squidbleed)
Affected Systems:	Squid Proxy (all versions with default FTP support enabled)
Disclosure Date:	June 10, 2026
Patch Status:	Fixed in Squid 7.6; upgrade to 7.7 recommended

References

1. Calif Security Research, “Squidbleed (CVE-2026-47729),” Calif Blog, June 10, 2026. https://blog.calif.io/p/squidbleed-cve-2026-47729 (accessed June 22, 2026).
2. Aviatrix Threat Research Center, “Squidbleed Vulnerability (CVE-2026-47729) Exposes Cleartext HTTP Requests,” Aviatrix, June 22, 2026. https://aviatrix.ai/threat-research-center/squidbleed-cve-2026-47729/ (accessed June 22, 2026).
3. The CyberSec Guru, “Squidbleed CVE-2026-47729: Inside Squid’s 29-Year-Old Bug,” The CyberSec Guru, June 2026. https://thecybersecguru.com/news/squidbleed-cve-2026-47729-squid-proxy-heap-overread/ (accessed June 22, 2026).
4. The Hacker News, “Squidbleed Heap Over-Read Vulnerability (CVE-2026-47729) Exposes Cleartext HTTP Requests,” June 22, 2026. https://thehackernews.com/ (accessed June 22, 2026).
5. Squid-cache.org, “Squid Proxy 7.6 Release Notes,” June 8, 2026. http://www.squid-cache.org/ (accessed June 22, 2026).