{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47729", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:29:25.483Z", "datePublished": "2026-07-16T16:13:19.767Z", "dateUpdated": "2026-07-17T18:07:10.084Z"}, "containers": {"cna": {"title": "Squid: Memory disclosure in FTP gateway", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1289", "lang": "en", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg"}, {"name": "https://github.com/squid-cache/squid/pull/2408", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/pull/2408"}, {"name": "https://github.com/squid-cache/squid/pull/2409", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/pull/2409"}, {"name": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8"}, {"name": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "tags": ["x_refsource_MISC"], "url": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6"}], "affected": [{"vendor": "squid-cache", "product": "squid", "versions": [{"version": "< 7.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:13:19.767Z"}, "descriptions": [{"lang": "en", "value": "Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6."}], "source": {"advisory": "GHSA-8c37-pxjq-qwrg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-16T17:52:23.166119Z", "id": "CVE-2026-47729", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-17T18:07:10.084Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-16T17:52:23.166119Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-16T17:52:28.864Z"}}], "cna": {"title": "Squid: Memory disclosure in FTP gateway", "source": {"advisory": "GHSA-8c37-pxjq-qwrg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "squid-cache", "product": "squid", "versions": [{"status": "affected", "version": "< 7.6"}]}], "references": [{"url": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "name": "https://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/squid-cache/squid/pull/2408", "name": "https://github.com/squid-cache/squid/pull/2408", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/pull/2409", "name": "https://github.com/squid-cache/squid/pull/2409", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "name": "https://github.com/squid-cache/squid/commit/865a131c7d557e68c965043d98c2eccae26deef8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "name": "https://github.com/squid-cache/squid/releases/tag/SQUID_7_6", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1289", "description": "CWE-1289: Improper Validation of Unsafe Equivalence in Input"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-07-16T16:13:19.767Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47729", "state": "PUBLISHED", "dateUpdated": "2026-07-17T18:07:10.084Z", "dateReserved": "2026-05-19T21:29:25.483Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-07-16T16:13:19.767Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{}

{"bugzilla": {"description": "squid: memory disclosure in FTP gateway", "id": "2492882", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492882"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in Squid. Due to improper input validation, an out-of-bounds read can occur in the FTP gateway. This issue allows an authenticated and trusted client to read memory from random transactions when accessing a misbehaving FTP server using the Squid gateway feature."], "mitigation": {"lang": "en:us", "value": "When FTP access is not required, block FTP traffic at the proxy by adding the following settings to the squid.conf configuration file above any custom 'http_access allow' rules:\n~~~\nacl FTP proto FTP\nhttp_access deny FTP\n~~~\nWhen FTP access is required, configure Squid to only allow FTP access to specific and trusted destination domains. See the example below for restricting FTP access to the 'trusted.server.example.com' domain:\n~~~\nacl FTP proto FTP\nacl ftp_allowlist dstdomain .trusted.server.example.com\nhttp_access deny FTP !ftp_allowlist\n~~~"}, "name": "CVE-2026-47729", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "squid34", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "squid:4/squid", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "squid", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-47729\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47729\nhttps://github.com/squid-cache/squid/security/advisories/GHSA-8c37-pxjq-qwrg"], "statement": "To exploit this issue, an attacker must have a valid account on the Squid proxy and must also control an FTP server reachable from the proxy on port 21. HTTPS traffic handled via CONNECT tunnels (the vast majority of modern web traffic) is opaque to the proxy because the underlying request data is encrypted and Squid does not have access to it. The impact is limited to information disclosure of cleartext HTTP request contents or traffic in TLS-terminating (SSL bump) proxy configurations where Squid decrypts and inspects traffic. FTP protocol usage has declined considerably in most environments since major browsers removed FTP support, further narrowing the practical attack surface. Due to these reasons, this vulnerability has been rated with a moderate severity.", "threat_severity": "Moderate"}