CVE-2026-47729 Details
Description
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
A memory disclosure vulnerability allowing out-of-bounds read has been identified in Squid, a web caching proxy. This issue affects versions prior to 7.6 and arises from improper validation of input in the FTP gateway. When a directory listing entry date in TypeA or TypeB formats is not followed by a filename, the parsing process can read beyond the input buffer. As a result, a trusted client can access random memory from unrelated transactions while using Squid's FTP gateway feature to connect to a problematic FTP server.
Users can upgrade to Squid version 7.6 to address this vulnerability. For those using a prepackaged version of Squid, please check with the package vendor for updated versions. If Squid is installed from the original source, the 'squid-users' mailing list is the primary support channel. Patches for this vulnerability in the stable release are available in the Squid patch archives.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| squid-cache squid | < 7.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |