Debian Linux - squid - None

Red Hat Enterprise Linux - squid: memory disclosure in FTP gateway

Ubuntu Linux - Out-of-bounds Read attack against the FTP gateway

Researchers used AI to discover a Heartbleed-style vulnerability in Squid Proxy called Squidbleed. We are monitoring for signals of exploitation attempts.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6360 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6360-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     June 21, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : squid     CVE ID         : CVE-2026-33515 CVE-2026-33526 CVE-2026-47729 CVE-2026-50012

    Multiple security issues were discovered in the Squid proxy caching     server, which could result in information disclosure or denial of service.

    For the stable distribution (trixie), these problems have been fixed in     version 6.13-2+deb13u2.

    We recommend that you upgrade your squid packages.

    For the detailed security status of squid please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/squid

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8435-1 advisory.

    It was discovered that Squid incorrectly handled FTP gateway processing under certain circumstances, which     could result in an out-of-bounds read. A remote attacker could use this issue to cause Squid to crash,     resulting in a denial of service, or possibly obtain sensitive information. (CVE-2026-47729)

    It was discovered that Squid incorrectly handled cache digest processing under certain circumstances,     which could result in a heap-based buffer overflow. A remote attacker could use this issue to cause Squid     to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2026-50012)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Debian Linux - squid - None  Ubuntu Linux - Out-of-bounds Read attack against the FTP gateway     (CVE-2026-47729)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321872	Debian dsa-6360 : squid - security update	Nessus	Debian Local Security Checks	critical
321371	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Squid vulnerabilities (USN-8435-1)	Nessus	Ubuntu Local Security Checks	critical
320881	Linux Distros Unpatched Vulnerability : CVE-2026-47729	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-47729

critical

Tenable Plugins

critical

critical

critical