This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Squid fixes 2 vulnerabilities
Squid fixes 2 vulnerabilities in version 7.6 [1][2].
Allows an authenticated remote attacker to read memory contents belonging to other users' requests and thereby obtain their sensitive data, due to incorrect handling of a response from a malicious FTP server in Squid's FTP gateway [1].
The vulnerability is present in product:
- Squid; <7.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2026-47729 at cve.org, NVD
- CWE-125: Out-of-bounds Read at cwe.mitre.org
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
- CWE-1286: Improper Validation of Syntactic Correctness of Input at cwe.mitre.org
The vulnerability was publicly disclosed 23. 6. 2026.
Allows an authenticated remote attacker to cause a heap overflow by sending a maliciously crafted response, due to insufficient input validation when exchanging a digest of cached content between cooperating proxy servers. The attack is limited to Squid instances compiled with the --enable-cache-digests option [2].
The vulnerability is present in product:
- Squid; <7.6
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H
More information:
- CVE-2026-50012 at cve.org, NVD
- CWE-20: Improper Input Validation at cwe.mitre.org
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 23. 6. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 23. 6. 2026.