CVE-2026-47729: squid-cache squid Out-of-bounds Read

Vulnerability summary

CVE-2026-47729 is a medium (CVSS 6.5) Out-of-bounds Read vulnerability in squid-cache squid. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 73.9% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 17-07-2026
   Last modifiedVulnerability information updated.

Description

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-1289Improper Validation of Unsafe Equivalence in InputThe product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.