Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Researchers used AI to discover a Heartbleed-style vulnerability in Squid Proxy called Squidbleed. We are monitoring for signals of exploitation attempts.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-e6bbab8aa8 advisory.

    - new version 7.6

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4697 advisory.

    - -----------------------------------------------------------------------     Debian LTS Advisory DLA-4697-1              debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Utkarsh Gupta     July 24, 2026                               https://wiki.debian.org/LTS
    - -----------------------------------------------------------------------

    Package        : squid     Version        : 4.13-10+deb11u7 5.7-2+deb12u6     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729                      CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of     service.

    For Debian 11 bullseye, these problems have been fixed in version     4.13-10+deb11u7.

    For Debian 12 bookworm, these problems have been fixed in version     5.7-2+deb12u6.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6360 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6360-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 6.13-2+deb13u2.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8435-1 advisory.

    It was discovered that Squid incorrectly handled FTP gateway processing under certain circumstances, which     could result in an out-of-bounds read. A remote attacker could use this issue to cause Squid to crash,     resulting in a denial of service, or possibly obtain sensitive information. (CVE-2026-47729)

    It was discovered that Squid incorrectly handled cache digest processing under certain circumstances,     which could result in a heap-based buffer overflow. A remote attacker could use this issue to cause Squid     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness     of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read:
    when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename,     parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server     through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed     in version 7.6. (CVE-2026-47729)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
330824	Fedora 44 : squid (2026-e6bbab8aa8)	Nessus	Fedora Local Security Checks	Local	medium
329264	Debian dla-4697 : squid - security update	Nessus	Debian Local Security Checks	Local	critical
321872	Debian dsa-6360 : squid - security update	Nessus	Debian Local Security Checks	Local	critical
321371	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Squid vulnerabilities (USN-8435-1)	Nessus	Ubuntu Local Security Checks	Local	critical
320881	Linux Distros Unpatched Vulnerability : CVE-2026-47729	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-47729

medium

Tenable Plugins

medium

critical

critical

critical

medium