CVE-2026-47729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47729", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:29:25.483Z", "datePublished": "2026-07-16T16:13:19.767Z", "dateUpdated": "2026-07-17T18:07:10.084Z"}, "containers": {"cna": {"title": "Squid: Memory disclosure in FTP gateway", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1289", "lang": "en", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg"}, {"name": "https://github.com/squid-cache/squid/pull/2408", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/pull/2408"}, {"name": "https://github.com/squid-cache/squid/pull/2409", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/pull/2409"}, {"name": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8"}, {"name": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6"}], "affected": [{"vendor": "squid-cache", "product": "squid", "versions": [{"version": "< 7.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:13:19.767Z"}, "descriptions": [{"lang": "en", "value": "Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6."}], "source": {"advisory": "GHSA-8c37-pxjq-qwrg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-16T17:52:23.166119Z", "id": "CVE-2026-47729", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T18:07:10.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T17:52:23.166119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T17:52:28.864Z"}}], "cna": {"title": "Squid: Memory disclosure in FTP gateway", "source": {"advisory": "GHSA-8c37-pxjq-qwrg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "squid-cache", "product": "squid", "versions": [{"status": "affected", "version": "< 7.6"}]}], "references": [{"url": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "name": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/squid-cache/squid/pull/2408", "name": "https://github.com/squid-cache/squid/pull/2408", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/pull/2409", "name": "https://github.com/squid-cache/squid/pull/2409", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "name": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "name": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:13:19.767Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47729", "state": "PUBLISHED", "dateUpdated": "2026-07-17T18:07:10.084Z", "dateReserved": "2026-05-19T21:29:25.483Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T16:13:19.767Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "squid", "vendor": "squid-cache", "versions": [{"status": "affected", "version": "< 7.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:squid-cache:squid:*:*:*:*:*:*:*:*", "matchCriteriaId": "D1EAA421-658A-4C10-A77B-EA9D38A3EFB8", "versionEndExcluding": "7.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6."}, {"lang": "es", "value": "Squid es un proxy de almacenamiento en cach\u00e9 para la Web. Antes de la versi\u00f3n 7.6, debido a una validaci\u00f3n incorrecta de la correcci\u00f3n sint\u00e1ctica de la entrada en la pasarela FTP (src/clients/FtpGateway.cc), Squid es vulnerable a una lectura fuera de l\u00edmites: cuando una fecha de entrada de listado en los formatos de listado de directorio TypeA o TypeB no es seguida por un nombre de archivo, el an\u00e1lisis no estaba restringido al b\u00fafer de entrada, por lo que un cliente de confianza que accede a un servidor FTP con comportamiento an\u00f3malo a trav\u00e9s de la caracter\u00edstica de pasarela de Squid podr\u00eda leer memoria de transacciones aleatorias no relacionadas. Este problema est\u00e1 solucionado en la versi\u00f3n 7.6."}], "id": "CVE-2026-47729", "lastModified": "2026-10-24T20:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47729", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-16T17:52:23.166119Z", "version": "2.0.3"}}]}, "published": "2026-07-16T17:16:57.217", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/squid-cache/squid/pull/2408"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/squid-cache/squid/pull/2409"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-1289"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "squid: memory disclosure in FTP gateway", "id": "2492882", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492882"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Squid. Due to improper input validation, an out-of-bounds read can occur in the FTP gateway. This issue allows an authenticated and trusted client to read memory from random transactions when accessing a misbehaving FTP server using the Squid gateway feature."], "mitigation": {"lang": "en:us", "value": "When FTP access is not required, block FTP traffic at the proxy by adding the following settings to the squid.conf configuration file above any custom 'http_access allow' rules:\n~~~\nacl FTP proto FTP\nhttp_access deny FTP\n~~~\nWhen FTP access is required, configure Squid to only allow FTP access to specific and trusted destination domains. See the example below for restricting FTP access to the 'trusted.server.example.com' domain:\n~~~\nacl FTP proto FTP\nacl ftp_allowlist dstdomain .trusted.server.example.com\nhttp_access deny FTP !ftp_allowlist\n~~~"}, "name": "CVE-2026-47729", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "squid34", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "squid:4/squid", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47729\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47729\nhttps://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg"], "statement": "To exploit this issue, an attacker must have a valid account on the Squid proxy and must also control an FTP server reachable from the proxy on port 21. HTTPS traffic handled via CONNECT tunnels (the vast majority of modern web traffic) is opaque to the proxy because the underlying request data is encrypted and Squid does not have access to it. The impact is limited to information disclosure of cleartext HTTP request contents or traffic in TLS-terminating (SSL bump) proxy configurations where Squid decrypts and inspects traffic. FTP protocol usage has declined considerably in most environments since major browsers removed FTP support, further narrowing the practical attack surface. Due to these reasons, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "squid", "vendor": "squid-cache"}], "created": "2026-06-26T01:30:17.131070+00:00", "updated": "2026-08-01T08:45:02.870813+00:00", "vendors": ["squid-cache", "squid-cache$PRODUCT$squid"]}