Listen to this Post
CVE-2026-47729, also known as “Squidbleed,” is a memory disclosure vulnerability in the Squid caching proxy that has existed for nearly three decades. The flaw resides in the FTP gateway component (src/clients/FtpGateway.cc) and stems from improper validation of syntactic correctness when parsing FTP directory listing responses. Specifically, the vulnerability is triggered when an FTP server sends a listing entry in the TypeA or TypeB format where a date is not followed by a filename. In this scenario, the parsing logic fails to restrict itself to the bounds of the input buffer, leading to an out-of-bounds read.
The root cause can be traced back to a 1997 code change intended to support NetWare FTP servers, which used four spaces instead of one between the timestamp and filename. The vulnerable code uses a `strchr` loop to skip whitespace characters. When the FTP listing line ends with a null terminator (\0) and no filename is present, `strchr` returns a pointer to that null terminator (as it is considered part of the string) instead of NULL. This causes the `++copyFrom` pointer to advance beyond the buffer boundary, walking through adjacent heap memory until it encounters a non-null, non-whitespace byte. The leaked data is then sent back to the attacker as a filename in the directory listing.
Squid reuses memory buffers from a 4KB pool without zeroing them. A short FTP line overwrites only the first few bytes of a previously used buffer that may have held a victim’s cleartext HTTP request, leaving the remainder of the 4KB buffer intact. This allows the out-of-bounds read to return stale, sensitive data from unrelated transactions.
The vulnerability is exploitable by an authenticated, trusted client who can direct the proxy to an attacker-controlled FTP server on port 21. Because FTP support is enabled by default and port 21 is included in the default `Safe_ports` ACL, no special configuration is required to enable the attack. The impact is limited to information disclosure, with a CVSS v3.1 base score of 6.5 (Moderate). The issue is fixed in Squid version 7.6 and later.
DailyCVE Form:
Platform: Squid Proxy
Version: < 7.6
Vulnerability: Out-of-bounds Read (CWE-125)
Severity: Moderate (CVSS 6.5)
date: July 16, 2026
Prediction: April 8, 2026 (patch)
What Undercode Say
Analytics & Detection:
- Public Exploit Status: PoC and technical details have been publicly disclosed.
- In-the-Wild Exploitation: No active exploitation has been reported as of June 2026.
- Global Exposure: Over 13 million risk assets worldwide are associated with this vulnerability, including more than 690,000 in China.
- Attack Prerequisites: Requires proxy authentication and the ability to reach an attacker-controlled FTP server.
- Common Deployments: Widely used in enterprise networks, schools, public Wi-Fi, and even in-flight Wi-Fi systems.
- Default Configuration: FTP gateway and port 21 are enabled by default, making the vulnerability accessible without special flags.
Bash Commands & Codes:
To check your Squid version:
squid -v | grep -i version
To find Squid instances vulnerable to CVE-2026-47729 across your network (using runZero query):
vendor:="Squid Cache" AND product:=Squid AND (version:>0 AND version:<7.6)
To block FTP traffic entirely as a temporary mitigation (in squid.conf):
acl FTP proto FTP http_access deny FTP
Alternatively, restrict FTP access to trusted destination domains only:
acl trusted_ftp_servers dstdomain .trusted.com acl FTP proto FTP http_access allow FTP trusted_ftp_servers http_access deny FTP
To verify the fix is applied, check for the patched code in FtpGateway.cc:
grep -n "if (!copyFrom)" src/clients/FtpGateway.cc
How Exploit Works
1. Attacker Setup: The attacker controls an FTP server reachable from the Squid proxy.
2. Triggering the Vulnerability: The attacker sends a malicious FTP directory listing where a date entry is not followed by a filename (e.g., d [R-F--] supervisor 512 Jan 16 18:53).
3. Parser Flaw: The vulnerable `while (strchr(w_space, copyFrom)) ++copyFrom;` loop receives a pointer to the null terminator. `strchr` does not return `NULL` because it treats the null terminator as part of the string.
4. Out-of-Bounds Read: The pointer advances past the buffer boundary, reading adjacent heap memory.
5. Data Leakage: The leaked bytes—which may include other users’ cleartext HTTP requests, Authorization headers, session tokens, cookies, or API keys—are returned to the attacker as the “filename” in the directory listing.
Protection
- Upgrade Squid: Update to version 7.6 or later, which contains the official fix.
- Verify the Fix: Confirm that the patch in `FtpGateway.cc` includes a null check before the `strchr` call.
- Disable FTP Gateway: If an upgrade is not immediately possible, block FTP traffic entirely using ACLs in
squid.conf. - Restrict FTP Access: Limit FTP access to only trusted destination domains.
- Network Segmentation: Ensure Squid proxies are not exposed as open gateways; restrict access to authenticated internal clients only.
- Monitor Traffic: Use detection queries to identify vulnerable Squid instances in your environment.
Impact
- Confidentiality: High. An attacker can read sensitive information from Squid’s heap memory, including cleartext HTTP requests, credentials, session tokens, and API keys.
- Integrity: None. The vulnerability does not allow modification of data.
- Availability: None. The vulnerability does not cause denial of service.
- Attack Complexity: Low. The attack does not require special conditions.
- Privileges Required: Low. The attacker must be an authenticated client of the proxy.
- User Interaction: None. No user interaction is required.
- Scope: Unchanged. The vulnerable component and the impacted component are the same.
- Affected Versions: All Squid versions prior to 7.6, including 5.x, 6.x, and earlier, dating back to 1997.
- Patch Availability: The fix was merged into the 8.x branch in April 2026 and backported to 7.6 in June 2026.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
