Squid: Memory disclosure in FTP gateway
CVE-2026-47729 is fixed in 7 products on 1 platform, first by squid 7.2-2ubuntu2.2, released June 11, 2026. It is not reported as exploited. Patch Radar priority: Routine.
Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| squid · Debian 12.15 (bookworm) | 5.7-2+deb12u6 | DEBIAN-CVE-2026-47729 | Jun 24, 2026 |
| squid · Debian 13.5 (trixie) | 6.13-2+deb13u2 | DEBIAN-CVE-2026-47729 | Jun 24, 2026 |
| squid · Debian 14 | 7.6-1 | DEBIAN-CVE-2026-47729 | Jun 24, 2026 |
| squid · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid · opensuse-leap 16.0 | 6.14-160000.1.1 | OPENSUSE-SU-2026:22080-1 | Nov 7, 2026 |
| squid · sles 15.6 | 6.14-150600.3.20.1 | SUSE-SU-2026:4621-1 | Nov 7, 2026 |
| squid · sles 15.7 | 6.14-150600.3.20.1 | SUSE-SU-2026:4621-1 | Nov 7, 2026 |
| squid · sles 16.0 | 6.14-160000.1.1 | SUSE-SU-2026:24224-1 | Nov 7, 2026 |
| squid-cgi · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-cgi 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-cgi · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-cgi 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-cgi · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-cgi 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-cgi · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-cgi 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-cgi · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-cgi 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-common · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-common 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-common · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-common 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-common · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-common 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-common · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-common 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-common · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-common 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-common · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid-common 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid-openssl · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-openssl 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-openssl · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-openssl 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-openssl · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-openssl 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid-openssl · Ubuntu 26.04.1 LTS (resolute) | 7.2-2ubuntu2.2 | squid-openssl 7.2-2ubuntu2.2 | Jun 11, 2026 |
| squid-purge · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid-purge 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squid-purge · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squid-purge 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squid-purge · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squid-purge 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squid-purge · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squid-purge 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squid-purge · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squid-purge 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
| squid3 · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squid3 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squidclient · Ubuntu 18.04.6 LTS (bionic) | 3.5.27-1ubuntu1.14+esm6 | squidclient 3.5.27-1ubuntu1.14+esm6 | Oct 24, 2026 |
| squidclient · Ubuntu 20.04 LTS (focal) | 4.10-1ubuntu1.13+esm3 | squidclient 4.10-1ubuntu1.13+esm3 | Oct 24, 2026 |
| squidclient · Ubuntu 22.04.1 LTS (jammy) | 5.9-0ubuntu0.22.04.7 | squidclient 5.9-0ubuntu0.22.04.7 | Jun 24, 2026 |
| squidclient · Ubuntu 24.04.5 LTS (noble) | 6.14-0ubuntu0.24.04.4 | squidclient 6.14-0ubuntu0.24.04.4 | Jun 24, 2026 |
| squidclient · Ubuntu 25.10 (questing) | 6.14-0ubuntu0.25.10.4 | squidclient 6.14-0ubuntu0.25.10.4 | Jun 24, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.