CVE-2026-47729CWE-125CWE-1289

Squid: Memory disclosure in FTP gateway

Medium · published July 16, 2026

CVSS v3.1
6.5
EPSS
2%
Percentile
74.1
In the wild
Unconfirmed
What it is

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01503 · 74.1th percentile
Weaknesses
CWE-125 · Out-of-bounds Read; CWE-1289 · Improper Validation of Unsafe Equivalence in Input
Published
2026-07-16T16:13Z
EPSS history
Timeline
  • 16 JUL 16:13Z
    Squid: Memory disclosure in FTP gateway
    cvelistv5