Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton era

1. Executive summary

A 29-year-old heap overread vulnerability in the Squid open-source caching proxy, tracked as CVE-2026-47729 and dubbed "Squidbleed," has been disclosed after going undetected since a 1997 commit. The flaw resides in Squid's FTP directory listing parser and leaks internal memory — including other users' cleartext HTTP requests carrying credentials and session tokens — to any attacker who can persuade the proxy to fetch a malicious FTP directory listing. The bug is fixed in Squid v7.6, released 8 June 2026. EMEA financial-services entities running Squid in default configuration with FTP support enabled are exposed; the immediate priority is to upgrade to v7.6 and disable FTP support where not strictly required. CVSS score is not yet published in the authoritative reference data and the vulnerability is not currently listed in CISA KEV.

2. Regulatory framing

3. Technical analysis & attack chain

1. Attacker stands up an FTP server on TCP port 21 reachable from the target Squid proxy.
2. Victim user traffic (or attacker-triggered request) causes Squid to issue an FTP passive-mode connection to the attacker's FTP server.
3. The FTP server returns a directory listing in which the filename field after the modification timestamp is empty or absent.
4. Squid's FTP directory listing parser (introduced in commit bb97dd37a, 1997, to support NetWare FTP servers) executes the loop while (strchr(w_space, *copyFrom)) ++copyFrom; against the empty filename.
5. copyFrom points to the terminating NUL byte; strchr treats the NUL as part of the searched string and returns a non-NULL pointer, so the loop never terminates.
6. The pointer walks off the end of the buffer; xstrdup then copies whatever memory follows back to the attacker as the "filename".
7. The attacker receives a heap overread containing fragments of other users' cleartext HTTP requests, which frequently carry Authorization: headers, session cookies, API keys, or other secrets.
8. The attacker parses the leaked memory for credentials and tokens and uses them to authenticate to upstream services.

Technical specifics

• Affected component: Squid FTP directory listing parser (NetWare whitespace-handling logic).
• Trigger conditions: Squid must (a) handle cleartext HTTP or be deployed in TLS-terminating mode, and (b) be permitted to reach an attacker-controlled FTP server on TCP port 21.
• Vulnerability mechanism: heap overread via unbounded strchr loop on a NUL-terminated string; xstrdup copies out-of-bounds heap memory back to the attacker.
• Patch: Squid v7.6 (released 8 June 2026); the fix checks for the NUL terminator before calling strchr.
• Default configuration: vulnerable out of the box; FTP support is enabled by default.
• Historical context: the bug was injected in 1997 (commit bb97dd37a) to handle NetWare FTP servers that emit extra whitespace between modification timestamp and filename.

Unconfirmed / single-sourced: the precise CVSS score is not yet published in the authoritative reference data; treat severity as "unknown" until NVD publishes a score. No MITRE ATT&CK technique mapping has been provided in the verified reference data; any actor attribution would be unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

• Upgrade all Squid deployments to v7.6 (released 8 June 2026). The vendor fix is the only complete remediation.
• Where an immediate upgrade is not possible, disable FTP support in squid.conf (remove or comment out ftp_passive, ftp_active, and any acl/url_regex rules permitting FTP) and restart Squid. This removes the attack surface entirely.
• Block egress to TCP port 21 from Squid proxy hosts at the perimeter firewall / cloud security group unless a specific, documented business need exists.

P2 — within 72 hours

• Audit Squid configuration for any acl rules permitting FTP URLs (ftp://) and remove them.
• Search egress firewall / proxy logs for outbound TCP/21 connections originating from Squid hosts in the last 12 months; investigate any unknown destinations.
• Review application logs for evidence of leaked credentials in HTTP request lines or headers; rotate any credentials that may have transited the proxy in cleartext.

P3 — within 7 days

• Add Squid v7.6 to the asset inventory and confirm patch coverage across all environments (dev, test, prod, DR).
• Document the decision to disable FTP and the residual risk in the third-party risk register per DORA Art. 28.
• Schedule a tabletop exercise to validate incident response under DORA Art. 17 in case a leak is confirmed.

5. Indicators of compromise

ftp-server  outbound TCP/21 from Squid proxy to non-corporate destination
commit-id   bb97dd37a

6. Detection

rule Squidbleed_FTP_Parser_Pattern
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-24"
        description = "Detects the vulnerable FTP directory listing parser code path in Squid (CVE-2026-47729 / Squidbleed)"
        reference = "https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367"

    strings:
        $strchr_call = "strchr"
        $w_space     = "w_space"
        $copyFrom    = "copyFrom"
        $xstrdup     = "xstrdup"
        $netware     = "NetWare"
        $squidbleed  = "Squidbleed"

    condition:
        3 of ($strchr_call, $w_space, $copyFrom, $xstrdup, $netware, $squidbleed)
}

title: Outbound FTP Connection from Squid Proxy Process
id: ad6e7c12-9f4b-4a2a-b1c0-squidbleed-2026
description: Detects Squid proxy initiating outbound FTP (TCP/21) connections, which is the attack precondition for CVE-2026-47729 (Squidbleed). Legitimate FTP traffic in most organisations is near zero.
author: Adverse Trace
date: 2026-06-24
reference: https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith:

      - '/squid'
    DestinationPort: 21
  condition: selection
fields:

  - User
  - CommandLine
  - DestinationIp
  - DestinationPort
falsepositives:

  - Legacy FTP services that legitimately traverse the proxy
level: high
tags:

  - attack.command_and_control
  - attack.t1071

CVE assessment

1 referenced CVE

7. Sources

• The Register — Mythos discovers 'Squidbleed,' a memory leak that's gone undetected since Clinton era — https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367 — 2026-06-23
• The Hacker News — 29-Year-Old Squid Proxy Bug 'Squidbleed' Can Leak Cleartext HTTP Requests — https://thehackernews.com/2026/06/29-year-old-squid-proxy-bug-squidbleed.html
• SecurityWeek — Decades-Old Squid Proxy Flaw 'Squidbleed' Can Expose User Data — https://www.securityweek.com/decades-old-squid-proxy-flaw-squidbleed-can-expose-user-data/

8. Adverse Trace position

Severity: high in principle (cleartext credential and session-token leakage to an unauthenticated network attacker) but constrained by the requirement that the proxy be allowed to reach an attacker-controlled FTP server on TCP/21; CVSS score is not yet published in the authoritative reference data and the vulnerability is not currently listed in CISA KEV. Client impact: any EMEA financial-services entity running Squid in default configuration with FTP support enabled and outbound TCP/21 permitted is at material risk of credential and session-token leakage. Next steps: Adverse Trace will (a) confirm Squid v7.6 deployment across monitored client estates within 24 hours, (b) assist with FTP egress blocking and configuration hardening, and (c) incorporate CVE-2026-47729 into ongoing third-party risk assessments under DORA Art. 28 and NIS2 Art. 21(2)(d).

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.