Squid proxy flaw Squidbleed can leak cleartext HTTP data

A significant vulnerability in the widely used Squid web proxy, nicknamed "Squidbleed," can leak fragments of users' cleartext HTTP traffic to other authorized users on the same proxy. The flaw, officially tracked as CVE-2026-47729, is a memory disclosure bug that traces its origin to a code change made in 1997.

Security researchers at Calif.io disclosed the vulnerability this month. They describe it as a heap buffer over-read within Squid's FTP directory listing parser. The bug allows an attacker who controls an FTP server reachable by the proxy to trigger the parser to read beyond its intended memory buffer. Squid reuses memory buffers without clearing them, so the data read can include remnants of a previous user's HTTP request, potentially exposing sensitive information like authorization headers, passwords, or API keys.

Exploitation requires specific conditions. The attacker must be an authorized user of the proxy, a common scenario in shared environments like corporate networks, schools, or public Wi-Fi hotspots. The leak only affects traffic that Squid can read in cleartext, meaning standard HTTP or HTTPS connections where Squid is configured to terminate and inspect TLS....