Dashboard / CVE-2026-47729

CVE-2026-47729

MEDIUM
MEDIUM Priority: 0.10 BB Relevance: 63/100
Published: 2026-07-16 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: None
A: None

Description

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway (src/clients/FtpGateway.cc), Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed by a filename, parsing was not restricted to the input buffer, so a trusted client accessing a misbehaving FTP server through Squid's gateway feature could read memory from random unrelated transactions. This issue is fixed in version 7.6.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
squid-cache squid < 7.6

References & Advisories (5)

Bug Bounty Relevance

63 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS — Exploitation Probability

1.50%
Raw Score 0.015030
Percentile 74.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.01503
2026-10-28
0.01503

Intelligence Sources

nvd ref →

External Links