CVE-2026-47729

Squid is a high-performance proxy caching server. It handles all requests in a single, non-blocking, I/O-driven process and keeps meta data and implements negative caching of failed requests.

Security Fix(es):

'Hi all,', "CVE-2026-47729\n\nDue to a Improper Validation of Syntactic Correctness of Input\nbug, Squid is vulnerable to a Out-of-bounds Read\nattack against the FTP gateway.\n\nThis problem allows a trusted client to perform an Out-of-Bounds\nRead from random unrelated transactions when accessing a\nmisbehaving FTP server through Squid's gateway feature.\n\n<", '>\n\n\n\nCVE-2026-50012\n\nDue to an Improper Input Validation bug, Squid is vulnerable to\na Heap-based Buffer Overflow attack against cache digests.\n\nThis problem allows a trusted server to perform a Heap-based\nBuffer Overflow when sending maliciously crafted replies to\ncache_digest request messages.\n\nThis attack is limited to Squid instances that have been\ncompiled with the --enable-cache-digests option.\n\n<', '>', 'Amos Jeffries\nThe Squid Software Foundation'

'Hi all,', "CVE-2026-47729\n\nDue to a Improper Validation of Syntactic Correctness of Input\nbug, Squid is vulnerable to a Out-of-bounds Read\nattack against the FTP gateway.\n\nThis problem allows a trusted client to perform an Out-of-Bounds\nRead from random unrelated transactions when accessing a\nmisbehaving FTP server through Squid's gateway feature.\n\n<", '>\n\n\n\nCVE-2026-50012\n\nDue to an Improper Input Validation bug, Squid is vulnerable to\na Heap-based Buffer Overflow attack against cache digests.\n\nThis problem allows a trusted server to perform a Heap-based\nBuffer Overflow when sending maliciously crafted replies to\ncache_digest request messages.\n\nThis attack is limited to Squid instances that have been\ncompiled with the --enable-cache-digests option.\n\n<', '>', 'Amos Jeffries\nThe Squid Software Foundation'

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

• SECURITY UPDATE: out-of-bounds read in the FTP gateway directory-listing parser when a TypeA/TypeB listing entry date is not followed by a filename
  • debian/patches/CVE-2026-47729.patch: restrict parsing to the input buffer in ftpListParseParts() by checking for a NUL byte before strchr(w_space) in src/clients/FtpGateway.cc
  • CVE-2026-47729
• SECURITY UPDATE: heap-based buffer overflow in cache digest reply handling when a peer reply's on-the-wire size exceeds the declared mask_size
  • debian/patches/CVE-2026-50012.patch: bound-check mask_offset + size against mask_size before memcpy() in peerDigestSwapInMask() and abort the fetch on overflow in src/peer_digest.cc
  • CVE-2026-50012

• SECURITY UPDATE: out-of-bounds read in FTP gateway listing parser
  • debian/patches/CVE-2026-47729.patch: guard against a NUL byte before strchr() in ftpListParseParts, preventing an out-of-bounds read that could disclose memory from unrelated transactions
  • CVE-2026-47729
• SECURITY UPDATE: heap buffer overflow in cache digest handling
  • debian/patches/CVE-2026-50012.patch: bound the mask copy in peerDigestSwapInMask so an on-the-wire payload larger than the advertised mask size cannot overflow the heap buffer
  • CVE-2026-50012

• CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size

• SECURITY UPDATE: out-of-bounds read in FTP gateway directory-listing parser
  • debian/patches/CVE-2026-47729.patch: guard the whitespace-skipping strchr(w_space, *copyFrom) checks in ftpListParseParts() with a '*copyFrom &&' short-circuit so a listing date that is not followed by a filename cannot advance parsing past the input buffer
  • CVE-2026-47729
• SECURITY UPDATE: heap buffer overflow in cache digest reply handling
  • debian/patches/CVE-2026-50012.patch: bounds-check the received mask data size against the declared mask_size before the memcpy in peerDigestSwapInMask(), aborting the digest fetch when the on-the-wire size is larger than the mask
  • CVE-2026-50012

• CVE-2026-47729: fix out-of-bounds read in FTP directory listing parsing when a TypeA/TypeB date is not followed by a filename
• CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared mask_size (heap buffer overflow)

• CVE-2026-47729: fix out-of-bounds read in the FTP directory listing parser (ftpListParseParts) by stopping the whitespace skip at the end of the input buffer
• CVE-2026-50012: fix heap buffer overflow in peerDigestSwapInMask by rejecting cache digest replies whose mask data exceeds the declared mask_size

• CVE-2026-47729: fix out-of-bounds read in the FTP directory listing parser (ftpListParseParts) by stopping the whitespace skip at the end of the input buffer
• CVE-2026-50012: fix heap buffer overflow in peerDigestSwapInMask by rejecting cache digest replies whose mask data exceeds the declared mask_size

• SECURITY UPDATE: out-of-bounds read in FTP gateway listing parser
  • debian/patches/CVE-2026-47729.patch: guard against a NUL byte before strchr() in ftpListParseParts, preventing an out-of-bounds read that could disclose memory from unrelated transactions
  • CVE-2026-47729
• SECURITY UPDATE: heap buffer overflow in cache digest handling
  • debian/patches/CVE-2026-50012.patch: bound the mask copy in peerDigestSwapInMask so an on-the-wire payload larger than the advertised mask size cannot overflow the heap buffer
  • CVE-2026-50012

• CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size

• CVE-2026-47729: fix out-of-bounds read in FTP gateway directory-listing parser when a listing entry date is not followed by a filename
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling (peerDigestSwapInMask) by bounding mask data against the declared mask_size

• CVE-2026-47729: fix out-of-bounds read in FTP gateway directory-listing parser when a listing entry date is not followed by a filename
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling (peerDigestSwapInMask) by bounding mask data against the declared mask_size

• CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size

• CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size

• CVE-2026-47729: fix out-of-bounds read in the FTP gateway directory listing parser that could disclose memory from unrelated transactions
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling when the on-the-wire payload exceeds the advertised mask size

• CVE-2026-47729: fix out-of-bounds read in FTP gateway directory-listing parser when a listing entry date is not followed by a filename
• CVE-2026-50012: fix heap buffer overflow in cache digest reply handling (peerDigestSwapInMask) by bounding mask data against the declared mask_size

• CVE-2026-47729: fix out-of-bounds read in FTP directory listing parsing when a TypeA/TypeB date is not followed by a filename
• CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared mask_size (heap buffer overflow)

The updated packages fix security vulnerabilities: Due to a Improper Validation of Syntactic Correctness of Inputbug, Squid is vulnerable to a Out-of-bounds Read attack against the FTP gateway. (CVE-2026-47729) Due to an Improper Input Validation bug, Squid is vulnerable to a Heap-based Buffer Overflow attack against cache digests. (CVE-2026-50012)

These are all security issues fixed in the squid-7.7-2.1 package on the GA media of openSUSE Tumbleweed.

This update for squid fixes the following issues:

• CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
• CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
• CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
• CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
• CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

Update to 6.14:

• Do not leak HttpReply when checking http_reply_access (bsc#1237027)

Root has patched CVE-2026-47729 in the squid package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-47729 in the rootio-squid package for Root:Debian:13. Multiple fixed versions available.

This update for squid fixes the following issues:

• CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
• CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
• CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
• CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
• CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

Update to 6.14:

• Do not leak HttpReply when checking http_reply_access (bsc#1237027)

This update for squid fixes the following issues:

• CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
• CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
• CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
• CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
• CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

Changes for squid:

• Do not leak HttpReply when checking http_reply_access (bsc#1237027)
• Updated to version 6.14

This update for squid fixes the following issues:

• CVE-2023-5824: Multiple issues in HTTP response caching (bsc#1216496).
• CVE-2023-49288: Use-After-Free in the HTTP Collapsed Forwarding Feature (bsc#1217825).
• CVE-2025-62168: failure to redact HTTP authentication credentials in error handling leads to the disclosure of credentials a trusted client uses to authenticate (bsc#1252281).
• CVE-2026-32748: denial of service in ICP Request handling (bsc#1260453).
• CVE-2026-33515: out of bounds read in ICP message handling (bsc#1260454).
• CVE-2026-33526: denial of service in ICP Request handling (bsc#1260452).
• CVE-2026-47729: out-of-bounds read attack against the ftp gateway due to a improper validation of syntactic correctness of input (bsc#1268272).
• CVE-2026-50012: Improper Input Validation bug (bsc#1268320).

It was discovered that Squid incorrectly handled FTP gateway processing under certain circumstances, which could result in an out-of-bounds read. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2026-47729)

It was discovered that Squid incorrectly handled cache digest processing under certain circumstances, which could result in a heap-based buffer overflow. A remote attacker could use this issue to cause Squid to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50012)

It was discovered that Squid incorrectly handled certain HTTP Transfer- Encoding headers. An attacker could possibly use this issue to perform HTTP request smuggling attacks, bypass security mechanisms, or poison web caches. (CVE-2026-61642)

It was discovered that Squid incorrectly handled certain cache digest replies, which could lead to a buffer overflow. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-50012)

It was discovered that Squid incorrectly handled parsing certain FTP directory listings. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-47729)

It was discovered that Squid incorrectly handled certain ICP traffic. A remote attacker could possibly use this issue to cause Squid to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-32748, CVE-2026-33526)

It was discovered that Squid incorrectly handled certain ICP requests. A remote attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2026-33515)