Squidbleed Vulnerability Can Leak HTTP Credentials From Squid Proxy Servers

A newly disclosed Squid Proxy vulnerability can leak sensitive HTTP data from memory, including authorization headers, cookies, passwords, and API keys, when specific FTP gateway conditions are met.

The flaw is called Squidbleed and is tracked as CVE-2026-47729. Researchers at Calif described it as a Heartbleed-style heap overread that has roots in Squid’s FTP directory listing parser dating back to 1997.

The Squid project disclosed the issue on the oss-security mailing list, where maintainer Amos Jeffries said CVE-2026-47729 allows a trusted client to perform an out-of-bounds read from unrelated transactions when accessing a misbehaving FTP server through Squid’s gateway feature.

What Squidbleed Does

Squidbleed affects the FTP gateway code used by Squid Proxy. The bug appears when Squid parses a crafted FTP directory listing line that ends after a timestamp but does not include a filename.

The vulnerable parser uses strchr to skip whitespace before a filename. The problem is that strchr can match the null terminator in a C string. When no filename follows the timestamp, Squid can advance past the end of the intended buffer and copy stale heap memory into the generated FTP directory listing response.

That stale memory may belong to another user of the same proxy. In a shared proxy environment, such as a school, company network, public access gateway, or managed Wi-Fi service, this can expose cleartext HTTP requests that passed through the proxy earlier.

Item	Details
Vulnerability name	Squidbleed
CVE	CVE-2026-47729
Affected component	Squid FTP gateway parser
Bug class	Out-of-bounds read, also described as a heap buffer overread
Main impact	Disclosure of memory from unrelated proxy transactions
Likely exposed data	Cleartext HTTP headers, cookies, API keys, session tokens, and credentials

Why the Bug Stayed Hidden for Decades

The issue traces back to old compatibility behavior for NetWare FTP servers. Some NetWare FTP listings used several spaces between the timestamp and filename, so Squid added logic to skip extra whitespace before extracting the filename.

The modern fix in Squid’s patch shows the root cause clearly. The code now checks that the current character is not null before calling strchr. The commit says the bug was probably introduced in a 1997 commit and duplicated in a later 2017 change.

Calif said Claude Mythos Preview helped identify the issue while analyzing Squid’s FTP state machine. Anthropic’s Mythos Preview research describes the model as especially capable at finding and reasoning about vulnerabilities in real open-source codebases.

How Attackers Could Exploit Squidbleed

The attack is serious, but it is not a simple internet-wide remote compromise. The attacker needs to be allowed to use the same Squid proxy and must control an FTP server that the proxy can reach.

Because Squid’s FTP support and TCP port 21 access have commonly existed in default proxy behavior, the attack surface can still be realistic in older or shared deployments. The attacker can trigger the bug by sending requests through the proxy to a malicious FTP server that returns a malformed directory listing.

The memory leak is especially sensitive because Squid reuses heap buffers. A buffer that previously stored a victim’s HTTP request can later get reused for FTP parsing. If only a short FTP line overwrites the beginning of that buffer, the rest can still contain the victim’s stale request data.

• The attacker must already be a trusted client of the same Squid proxy.
• The proxy must be able to reach an attacker-controlled FTP server.
• The leaked traffic must be readable by Squid, such as cleartext HTTP.
• Normal HTTPS CONNECT tunnels are not exposed in the same way because Squid does not see the encrypted contents.
• TLS interception or inspection setups can increase the sensitivity of the data Squid holds in memory.

Patch Status and Version Confusion

The Squid project initially said Squid 7.6 contained fixes for CVE-2026-47729 and CVE-2026-50012. A later oss-security follow-up noted confusion around whether CVE-2026-47729 was fixed in 7.6 or expected in 7.7.

Administrators should therefore check their vendor advisory and confirm the exact patch, not just the upstream version number. The relevant fix is the change in FtpGateway.cc that adds a null-character guard before strchr.

The Debian security tracker lists CVE-2026-47729 status across Debian releases and identifies fixed packages for trixie security and unstable. Other Linux distributions may backport the patch into older Squid versions, so package version alone may not tell the full story.

How Admins Should Respond

Organizations running Squid should update to a build that contains the fix for CVE-2026-47729. They should also consider disabling FTP proxying unless they have a clear business need for it.

The Calif disclosure recommends disabling FTP support because modern browser use of FTP has largely disappeared. Removing that legacy feature can eliminate the exposed parser path in many environments.

Security teams should also review whether Squid handles cleartext HTTP or performs TLS interception. Environments that process credentials, internal applications, or API traffic through Squid should treat this as a higher-priority issue.

Action	Why it helps
Apply the vendor patch	Fixes the out-of-bounds read in the FTP gateway parser
Verify commit 865a131 or the vendor backport	Reduces risk from version-number confusion
Disable FTP proxying if unused	Removes the vulnerable feature path
Restrict outbound FTP to trusted destinations	Prevents attackers from using their own FTP server as a trigger
Review cleartext HTTP usage	Limits credential exposure through proxy memory
Rotate exposed credentials where needed	Reduces risk if HTTP authorization headers or tokens were leaked

Why This Is More Than a Squid Bug

Squidbleed shows how old compatibility code can remain dangerous long after the technology it supported becomes rare. FTP parsing, NetWare compatibility, and manual C string handling are easy to overlook during modern security reviews.

The GitHub commit fixes the issue with only two added null checks. The small size of the patch highlights how a tiny C API assumption can produce a major confidentiality problem when the code runs inside a multi-user proxy.

The discovery also adds to the debate around AI-assisted security research. Anthropic has said Mythos Preview can find subtle bugs in open-source projects, while also warning that stronger security models could change both defensive auditing and offensive exploit development.

What to Check in Squid Deployments

Admins should start by identifying every Squid instance, including older appliances, transparent proxies, filtering gateways, school or office proxy servers, and embedded network products that may bundle Squid.

Next, they should confirm whether the Squid build includes the fixed parser code. The Debian tracker provides one example of how distribution-level package status can differ from upstream release discussions.

Finally, teams should inspect logs for unexpected FTP gateway use. If no legitimate users need FTP through Squid, disabling the feature is the safest long-term choice.

FAQ