Squid Proxy FTP listing parser heap over-read

CVE-2026-47729, dubbed Squidbleed by Lam Jun Rong at Calif.io, is a heap over-read in Squid's FTP directory-listing parser. When the proxy parses a malformed FTP response missing a filename, strchr(w_space, '\0') returns a pointer to the NUL terminator (legal per C11 §7.24.5.2), advancing copyFrom past the 4 KB MEM_4K_BUF boundary. Because Squid recycles those buffers without zeroing, the over-read leaks whatever previously lived in that slab — typically other users' HTTP requests, Authorization headers, cookies, and POST bodies. Every Squid release since 1997 is affected in the default configuration; the fix landed in Squid 7.6 (8 June 2026), backported to v7 on 17 May 2026 and merged into master/v8 on 19 April 2026. Distro packages (SUSE, Debian, RHEL, Ubuntu) are still rolling.

Vendor severity is uneven: there is no NVD/MITRE CVSS yet; SUSE rates it CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/C:H/I:N/A:N) as a *moderate* information disclosure. That under-prices the real-world blast radius. The PR:L assumption presumes the attacker needs proxy auth, but in most enterprise forward-proxy and almost every CDN/reverse-proxy deployment the FTP fetch is triggered by *any* downstream client (including the attacker as a downstream consumer of the same proxy). The leaked bytes are cross-*user*, cross-*tenant* secrets. Calling this a 6.5 is the same mistake the industry made the morning of Heartbleed.

Why this verdict

• Heartbleed-class primitive, public PoC, zero auth in practice — the attacker only needs the proxy to fetch ftp://attacker/, which any downstream client (including the attacker themselves on most reverse-proxy edges) can trigger. SUSE's PR:L assumption does not hold in CDN or anonymous-forward deployments.
• Role multiplier — reverse-proxy / CDN edge: chain succeeds; blast radius is *cross-tenant* HTTP request + cookie + Authorization header disclosure. This is the canonical Squid-as-edge deployment and pushes the floor to HIGH.
• Role multiplier — TLS-terminating corporate forward proxy (SSL bump): chain succeeds; blast radius is workforce-wide SaaS credential and session-cookie theft from anyone whose decrypted traffic passes through the proxy. Common in regulated enterprises that do egress inspection.
• Role multiplier — pure CONNECT forward proxy (no TLS termination): chain still triggers, but leaked bytes are mostly TLS ciphertext and a small population of cleartext-HTTP browsing — narrower but non-zero impact. This is the only role that argues *against* HIGH.
• Friction discount applied: worker concurrency and HTTPS-dominant traffic mean each over-read returns a probabilistic slice of useful data, not deterministic credentials — this is why we sit at 7.6 rather than 8.5+.
• Not on KEV, no observed exploitation yet — keeps us under CRITICAL. If credential-replay attacks surface, expect rapid KEV addition and upgrade.

Why not higher?

No active exploitation and no deterministic single-shot credential extraction (the leak is probabilistic across a 4 KB window). Pure CONNECT-only forward proxies — a non-trivial share of installs — leak mostly ciphertext. CRITICAL would require demonstrated cross-tenant compromise in the wild or a deterministic credential primitive.

Why not lower?

SUSE's 6.5 / MEDIUM under-prices the cross-user, cross-tenant nature of the leak and presumes proxy authentication that most real deployments don't enforce against arbitrary FTP URLs. Every Squid build since 1997 is affected, a public PoC leaks Authorization headers, and the canonical Squid roles are *exactly* the multi-tenant ones where the blast radius is largest. Calling this MEDIUM ignores the role-multiplier rule.

1. Disable the FTP scheme handler in squid.conf — Add acl FTP proto FTP and http_access deny FTP (or remove port 21 from Safe_ports and reject ftp:// URLs at the front door). This severs step 2 of the chain — the parser never runs. Deploy within 30 days per the noisgate HIGH mitigation SLA; do it today on internet-facing reverse proxies.
2. Block outbound TCP/21 from the proxy tier at the egress firewall — Defense-in-depth in case someone re-enables FTP in squid.conf. Most modern enterprise egress already denies FTP; verify rather than assume. Same 30-day noisgate HIGH mitigation deadline; minutes of firewall work.
3. Restart Squid workers on a short cadence until patched — Rolling worker restarts (e.g., squid -k reconfigure hourly, or systemd timer) flush the recycled MEM_4K_BUF slabs and shorten the leak window. Crude but cheap and immediate while you wait for the distro backport.
4. Upgrade to Squid 7.6 (or apply distro backport when available) — The actual fix. Track Debian/Ubuntu/RHEL/SUSE security trackers; for self-built Squid pull v7.6 today. Complete the upgrade within the noisgate HIGH 180-day remediation SLA — sooner on internet-facing edges.
5. Rotate any Basic-auth and bearer tokens that may have traversed a TLS-terminating Squid since April 2026 — Assume disclosure on multi-tenant CDN and SSL-bumping forward proxies. Force re-auth, invalidate long-lived API tokens, and rotate service-account credentials whose traffic was proxied.

Run on each Squid host as root (or any user that can read squid.conf and run squid -v). Invoke as sudo ./check-squidbleed.sh — the script reports VULNERABLE, PATCHED, or UNKNOWN and exits 1, 0, or 2 respectively. Also flags whether FTP is reachable in the Safe_ports ACL.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-47729 "Squidbleed"
# Detects Squid version and FTP-scheme exposure.
set -u

SQUID_BIN="$(command -v squid || true)"
CONF="${SQUID_CONF:-/etc/squid/squid.conf}"
[ -f "$CONF" ] || CONF="/etc/squid3/squid.conf"

if [ -z "$SQUID_BIN" ]; then
  echo "UNKNOWN: squid binary not found in PATH"; exit 2
fi

VER=$("$SQUID_BIN" -v 2>/dev/null | awk -F'Version ' '/Version/ {print $2}' | awk '{print $1}')
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse Squid version"; exit 2
fi

# Fixed in 7.6+; distros may carry backported patches in earlier strings.
ver_ge() { printf '%s\n%s\n' "$2" "$1" | sort -V -C; }

FTP_EXPOSED="unknown"
if [ -r "$CONF" ]; then
  if grep -Eq '^\s*acl\s+Safe_ports\s+port\s+.*\b21\b' "$CONF" && \
     ! grep -Eq '^\s*http_access\s+deny\s+.*(FTP|ftp)' "$CONF"; then
    FTP_EXPOSED="yes"
  else
    FTP_EXPOSED="no"
  fi
fi

if ver_ge "$VER" "7.6"; then
  echo "PATCHED: Squid $VER (>=7.6) — FTP-scheme reachable=$FTP_EXPOSED"
  exit 0
fi

# Check for distro backport hint in changelog (best-effort)
if command -v dpkg >/dev/null 2>&1; then
  CHG=$(dpkg -s squid 2>/dev/null | awk '/^Version:/ {print $2}')
  if echo "$CHG" | grep -Eqi 'CVE-2026-47729|squidbleed'; then
    echo "PATCHED: distro backport detected ($CHG)"; exit 0
  fi
fi

if [ "$FTP_EXPOSED" = "no" ]; then
  echo "VULNERABLE-BUT-MITIGATED: Squid $VER, FTP scheme blocked in config"
  exit 1
fi

echo "VULNERABLE: Squid $VER < 7.6, FTP-scheme reachable=$FTP_EXPOSED"
exit 1

Sources

1. Calif.io — Squidbleed writeup (researcher)
2. Calif.io PoC repository
3. oss-sec — Squid CVE-2026-47729 disclosure thread
4. SUSE security tracker entry
5. CVE Record
6. Malware.news mirror / discussion
7. Debian security tracker (stable status)