Description
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
Published: 2026-07-16
Score: 6.5 Medium
EPSS: 1.5% Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out‑of‑bounds read: when a listing entry date in the TypeA or TypeB directory‑listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6. This weakness results from insufficient input validation and is categorized as CWE-125 and CWE-1289.

Affected Systems

All installations of the Squid caching proxy that enable the FTP gateway feature are affected. No specific version range is supplied; users should examine their version and compare it against the advisory for the fix.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate risk. An EPSS score of 2% shows a low but measurable exploitation probability, and the vulnerability is not listed in CISA KEV. Exploiting the FTP gateway, so only users with legitimate credentials and trusted network positions could leverage this weakness to read arbitrary memory.

Generated by OpenCVE AI on August 1, 2026 at 08:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Squid to the latest version that contains the patch for the FTP gateway out‑the FTP gateway feature or restrict its use to trusted networks only.
  • Limit authentication to authorized clients FTP traffic through Squid to mitigate potential exposure.
  • If the FTP gateway feature is not needed, disable it in the Squid configuration.

Generated by OpenCVE AI on August 1, 2026 at 08:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4697-1 squid security update
Debian DSA Debian DSA DSA-6360-1 squid security update
History

Fri, 17 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 16 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Description A flaw was found in Squid. Due to improper input validation, an out-of-bounds read can occur in the FTP gateway. This issue allows an authenticated and trusted client to read memory from random transactions when accessing a misbehaving FTP server using the Squid gateway feature. Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
Title squid: memory disclosure in FTP gateway Squid: Memory disclosure in FTP gateway
Weaknesses CWE-1289
References

Fri, 26 Jun 2026 06:00:00 +0000

Type Values Removed Values Added
First Time appeared Squid-cache
Squid-cache squid
Vendors & Products Squid-cache
Squid-cache squid

Fri, 26 Jun 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw was found in Squid. Due to improper input validation, an out-of-bounds read can occur in the FTP gateway. This issue allows an authenticated and trusted client to read memory from random transactions when accessing a misbehaving FTP server using the Squid gateway feature.
Title squid: memory disclosure in FTP gateway
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Subscriptions

Squid-cache Squid
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-17T18:07:10.084Z

Reserved: 2026-05-19T21:29:25.483Z

Link: CVE-2026-47729

cve-icon Vulnrichment

Updated: 2026-07-16T17:52:28.864Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-06-23T00:00:00Z

Links: CVE-2026-47729 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T08:45:02Z

Weaknesses
  • CWE-125

    Out-of-bounds Read

  • CWE-1289

    Improper Validation of Unsafe Equivalence in Input