CVE-2026-47729
MediumCVSS 6.5Exploitation Probability (EPSS)
High risk78th percentile - higher than 78% of all known CVEs
Summary
Squid versions prior to 7.6 have an out-of-bounds read vulnerability in the FTP gateway. Improper validation of directory listing date syntax may allow a trusted client to read memory from unrelated transactions.
Risk Assessment
The risk involves potential leakage of sensitive data from the proxy server's memory, which could expose information about other user sessions to the organization.
Recommendation
Immediately upgrade Squid to version 7.6 or later, which includes the fix for this vulnerability.
Other vulnerabilities in Squid
See all- CVE-2016-4556High
A double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
- CVE-2016-4554High
The mime_header.cc file in Squid before version 3.5.18 contains a vulnerability that allows remote attackers to bypass intended same-origin restrictions and potentially conduct cache-poisoning attacks via a crafted HTTP Host header, known as a 'header smuggling' issue.
- CVE-2016-4553High
The client_side.cc file in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when an absolute URI is provided, allowing remote attackers to conduct cache-poisoning attacks.
- CVE-2016-4054High
A buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-4052High
Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- CVE-2016-3948High
Squid versions 3.x before 3.5.16 and 4.x before 4.0.8 improperly perform bounds checking, allowing remote attackers to cause a denial of service via a crafted HTTP response related to Vary headers.
- CVE-2016-2571High
In Squid 3.x before version 3.5.15 and 4.x before version 4.0.7, http.cc continues to store data after a response-parsing failure. This allows remote HTTP servers to cause a denial of service by sending a malformed response.
- CVE-2016-2569High
Squid versions 3.x before 3.5.15 and 4.x before 4.0.7 do not properly append data to String objects, allowing remote servers to cause a denial of service (assertion failure and daemon exit) via a long string, as demonstrated by a crafted HTTP Vary header.
- CVE-2026-33526High
Squid versions prior to 7.5 contain a heap Use-After-Free vulnerability in ICP traffic handling, allowing a remote attacker to perform a reliable and repeatable Denial of Service attack. The attack requires ICP support enabled (non-zero `icp_port`) and cannot be mitigated by `icp_access` rules.
- CVE-2026-32748High
Squid versions prior to 7.5 have a vulnerability due to premature resource release and heap Use-After-Free bugs, allowing a DoS attack via ICP traffic. This affects only deployments with ICP explicitly enabled (non-zero `icp_port`).
Original NVD description (English source)
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.