29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests
Summary: A heap over-read in the Squid web proxy, traced to a 1997 FTP-parsing change and still present in the default configuration, can leak another user's cleartext HTTP request, including credentials and session tokens, to anyone already permitted to send traffic through the same proxy. Researchers at Calif.io disclosed the bug in June as Squidbleed (CVE-2026-47729), and proof-of-concept code is public with no in-the-wild exploitation reported as of writing.
What you should know: The attacker needs only the proxy access a student or office worker already has, and Calif's demo pulled an Authorization header from a victim on the same proxy - enough to act as that user. SUSE rates it moderate at CVSS 6.5, and the researchers' recommended fix is to turn FTP off, which most networks can do at no cost.
Read the original at The Hacker News ↗
- Mentions
- CVE-2026-47729CVE-2026-50012
- Related