Critical Squidbleed Vulnerability Exposes Sensitive Data for Nearly 30 Years

A significant heap buffer overread vulnerability, named Squidbleed and tracked as CVE-2026-47729, has been found in the Squid web proxy, affecting its FTP directory-listing parser since 1997. This flaw allows trusted clients to leak internal memory, potentially exposing sensitive data such as HTTP requests, passwords, and API keys. Security researchers from Calif.io disclosed the vulnerability, which can impact users of the Squid Proxy. The vulnerability is reminiscent of the Heartbleed bug, posing a serious risk to data confidentiality. Users are urged to assess their systems for potential exposure. As of today, no patches have been reported, and the vulnerability remains unaddressed.

Key Points: • CVE-2026-47729 allows leaking of sensitive data from Squid Proxy since 1997. • The vulnerability can expose HTTP headers, passwords, and API keys. • No patches have been released yet, leaving systems vulnerable.