Skip to content
OpenAdvisories
Medium · 6.5 Public exploit CVE-2026-47729 EUVD-2026-44962

Squid: Memory disclosure in FTP gateway

Published Jul 16, 2026 · Updated Jul 17, 2026 · Assigned by GitHub_M

Vendor: squid-cache Product: squid Package: squid Package: squid Package: squid Package: squid Package: squid3 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Affected products

VendorProductAffectedFixed
squid-cache squid < 7.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 squid 7.6-1 —
Debian 13 squid 6.13-2+deb13u2 —
Debian 12 squid 5.7-2+deb12u6 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS squid 7.2-2ubuntu2.2 —
Ubuntu 25.10 squid 6.14-0ubuntu0.25.10.4 —
Ubuntu 24.04 LTS squid 6.14-0ubuntu0.24.04.4 USN-8941-1
Ubuntu 22.04 LTS squid 5.9-0ubuntu0.22.04.7 USN-8941-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS squid 4.10-1ubuntu1.13+esm3 USN-8941-1
Ubuntu Pro 18.04 LTS squid3 3.5.27-1ubuntu1.14+esm6 USN-8941-1
Ubuntu Pro 16.04 LTS squid3 3.5.12-1ubuntu7.16+esm7 USN-8941-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES 15 SP6 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 squid 6.14-160000.1.1 SUSE-SU-2026:24224-1
SLES for SAP 15 SP6 squid 6.14-150600.3.20.1 SUSE-SU-2026:4621-1
SLES for SAP 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES for SAP 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLES 16.0 squid 6.14-160000.1.1 SUSE-SU-2026:24224-1
SLE HPC 15 SP5 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1
SLE HPC 15 SP4 squid 5.7-150400.3.41.1 SUSE-SU-2026:4909-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed squid 7.7-2.1 openSUSE-SU-2026:11937-1
openSUSE Leap 16.0 squid 6.14-160000.1.1 openSUSE-SU-2026:22080-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 squid 7.6-r0 —
Alpine v3.23 squid 7.6-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 squid 6.13-5 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 7

References