Security researchers at Calif.io have revealed a decades-old memory leak vulnerability in Squid Proxy, dubbed ‘Squidbleed’, which can expose user data. This vulnerability, tracked as CVE-2026-47729, has been present since 1997 and allows the FTP parser in Squid to read beyond a memory buffer, potentially revealing previous users’ HTTP request data. Attackers could exploit this flaw in shared proxy environments, such as those found in corporate networks or public Wi-Fi hotspots, to capture sensitive information like authentication credentials. The threat is particularly concerning because it affects cleartext HTTP traffic, although recent patches have been released in June 2026 to mitigate risks. The discovery of Squidbleed was aided by AI analysis, which has also recently helped identify other significant vulnerabilities in networking software.

Squid: Squid is a widely used open source web proxy caching server that supports protocols including HTTP, HTTPS, and FTP to optimize bandwidth and response times. Security researchers recently disclosed a long-standing memory leak vulnerability in its FTP parser, dubbed Squidbleed, that can expose prior user data in shared environments. The flaw affects deployments where Squid terminates TLS and has been addressed through patches in recent releases.
Calif.io: Calif.io is a security research organization specializing in vulnerability discovery within widely deployed software. The group identified and publicly disclosed the Squidbleed flaw in Squid Proxy, along with separate high-severity issues in OpenSSL and HTTP/2 implementations. Their work incorporates advanced AI tools to analyze complex code paths and uncover subtle memory safety problems.

Proxy Environments: Shared proxy setups in enterprise and public networks continue to present elevated risks for unintended data exposure from legacy protocol handling.
Mitigation Approaches: Disabling optional protocol support offers a straightforward way to reduce attack surface in proxy configurations without requiring immediate upgrades.
Vulnerability Discovery: AI-assisted analysis has proven effective for identifying subtle memory safety issues in mature open source networking software.