Vulnerabilities · 84 days ago
A shared Squid proxy can keep the last user’s request data alive long enough for the next user to read it back. The bug is in the FTP parser, which can read past the end of its buffer and pull in uncleared HTTP request data from memory, so the usual assumption that a proxy separates users cleanly no longer holds in multi-tenant setups.
Calif.io says CVE-2026-47729 has existed since 1997 and affects Squid Proxy deployments that route traffic for schools, enterprises, and public Wi‑Fi. The exposed data can include credentials, session tokens, and API keys from cleartext HTTP traffic, especially when an attacker controls an FTP server the proxy will talk to. Squid 8 includes the fix, and version 7.6 shipped the patch in June 2026.
A nearly 30-year-old parser bug creates a latent cross-user data-retention problem in shared proxy environments, even when the proxy itself is otherwise trusted.
2 sources covering this story
29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
Squidbleed CVE-2026-47729 can expose cleartext HTTP credentials from users sharing the same Squid proxy.
Decades-Old Squid Proxy Flaw ‘Squidbleed’ Can Expose User Data
Squidbleed, discovered with the aid of Claude Mythos Preview, has been described as a Heartbleed-style vulnerability.
Part of the PlainSec briefing for 2026-06-22