29-Year-Old Squid Proxy Vulnerability Exposes Authorization Headers and API Keys

A recently disclosed vulnerability in Squid Proxy, tracked as CVE-2026-47729 and referred to as “Squidbleed,” is exposing sensitive user data, including HTTP authorization headers and API keys.

This issue arises from a decades-old memory-handling flaw in Squid’s codebase, dating back to at least 1997. It affects default configurations and illustrates how support for legacy protocols can introduce modern security risks.

29-Year-Old Squid Proxy Vulnerability

Squid is a widely used caching and forwarding proxy found in enterprise networks, educational institutions, and ISP environments. It includes built-in support for FTP in addition to HTTP.

Despite a decline in FTP traffic in modern settings, the protocol is still enabled by default in Squid, which is the root of this vulnerability. The flaw stems from how Squid’s FTP directory listing parser handles null-terminated strings, leading to a heap buffer overflow condition.

At the heart of the problem is a subtle misuse of the C standard library function `strchr()`. According to the C specification, searching for the null terminator (‘\0’) within a string returns a valid pointer instead of NULL.

Squid’s parsing logic fails to address this edge case adequately. When it processes malformed or incomplete FTP directory listings, particularly those that lack a filename after a timestamp, the parser continues incrementing a pointer beyond the buffer’s boundary. This results in unintended reads of adjacent heap memory.

The vulnerability is particularly dangerous due to Squid’s memory management design. Squid uses fixed-size memory pools (notably 4KB buffers) that are recycled without being cleared.

Consequently, previously stored data, such as HTTP request contents, can persist in memory even after being freed. When the vulnerable FTP parser reads beyond its intended buffer, it may inadvertently expose this residual data.

In practical exploitation scenarios observed by Calif, an attacker only needs control of an FTP server accessible to the vulnerable Squid instance. By crafting malicious directory listings and repeatedly triggering the parsing flaw, attackers can leak portions of memory associated with other users’ sessions.

This can include sensitive HTTP headers such as authorization tokens or API keys, especially in environments where Squid handles plaintext HTTP traffic or performs TLS interception.

While the impact is somewhat limited, modern HTTPS traffic typically tunnels via the CONNECT method. It is not directly parsed; the risk remains significant in corporate environments where SSL inspection is active or legacy HTTP services are still in use.

Moreover, Squid deployments in shared environments (e.g., multi-user networks or public Wi-Fi systems) increase the likelihood of cross-user data exposure.

This vulnerability affects multiple versions of Squid across many years of releases, highlighting concerns regarding supply chain and legacy risks. A patch has been issued that introduces a straightforward but effective fix: explicitly checking for the null terminator before calling `strchr()`, thereby preventing a pointer overrun.

Security researchers emphasize that this bug exemplifies the long-term risks associated with mature open-source software, where subtle implementation details can evade detection for years. The discovery also underscores the increasing importance of AI-assisted code analysis in identifying such edge-case vulnerabilities.

Organizations using Squid are strongly advised to apply the latest patches immediately. As an additional mitigation measure, turning off FTP support, especially in environments where it is no longer needed, can eliminate the attack surface. Given that most modern browsers and applications no longer rely on FTP, this step is both practical and low-impact.

The Squidbleed vulnerability serves as a reminder that even well-established infrastructure components can harbor critical flaws, particularly when legacy features remain enabled by default.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.