Squidbleed Lets One User’s Requests Leak to Another
A shared Squid proxy can keep the last user’s request data alive long enough for the next user to read it back. The bug is in the FTP parser, which can read past the end of its buffer and pull in uncleared HTTP request data from memory, so the usual assumption that a proxy separates users cleanly no longer holds in multi-tenant setups.
Calif.io says CVE-2026-47729 has existed since 1997 and affects Squid Proxy deployments that route traffic for schools, enterprises, and public Wi‑Fi. The exposed data can include credentials, session tokens, and API keys from cleartext HTTP traffic, especially when an attacker controls an FTP server the proxy will talk to. Squid 8 includes the fix, and version 7.6 shipped the patch in June 2026.
A nearly 30-year-old parser bug creates a latent cross-user data-retention problem in shared proxy environments, even when the proxy itself is otherwise trusted.