Junglewise Threat Intelligence

CVE-2026-47729: Squid out-of-bounds read in FTP gateway directory parsing

CVE-2026-47729 · Severity: medium · CVSS 6.5 · Published 2026-07-16

Executive brief

Squid, a widely used web caching proxy, contains a vulnerability in its FTP gateway component. An attacker using a trusted client can connect to a malicious or misbehaving FTP server through the proxy to trigger a memory leak. This could allow the attacker to read sensitive information from other unrelated user sessions or system transactions, potentially compromising private data.

Technical details

An out-of-bounds read vulnerability exists in Squid's FTP gateway (src/clients/FtpGateway.cc) due to improper validation of TypeA and TypeB directory-listing formats. When a listing entry date is not followed by a filename, the parser fails to restrict its search to the input buffer, continuing into adjacent memory. This is caused by unsafe usage of the C function strchr(), which returns a pointer to the NUL terminator if the character sought is not found, leading the subsequent pointer increment to move beyond the buffer. An attacker with 'trusted client' status can exploit this by forcing the proxy to connect to a specially crafted FTP server, resulting in the disclosure of memory from concurrent, unrelated transactions. The issue is fixed in version 7.6.

Affected products

  • Squid-cache Squid < 7.6

Timeline

  • 2026-04-17: other: Initial fix developed and pull request opened
  • 2026-06-08: patched: Squid version 7.6 released
  • 2026-06-23: advisory: Project security advisory GHSA-8c37-pxjq-qwrg published
  • 2026-07-16: disclosed: CVE-2026-47729 published to NVD

References