Squid Proxy (versions before 7.6 / before patch merged in Squid 8)

Squid's FTP parser does not properly bound-check where it reads from in memory. When triggered, it can read beyond the data it's supposed to access and into memory still holding fragments of someone else's request — including, potentially, authentication credentials, session tokens, and API keys, if that traffic was unencrypted HTTP.

An attacker who controls an FTP server reachable through the proxy can trigger the bug, causing the proxy to leak fragments of another user's recent HTTP traffic. The exposure is limited to cleartext HTTP — standard HTTPS connections relayed as opaque tunnels are not affected — but cleartext HTTP credentials still travel through plenty of enterprise and legacy systems.

1. Check your Squid version against the patched releases — version 7.6 and the Squid 8 branch both include the fix.
2. Audit whether your Squid deployment has FTP support enabled at all; if it's unused, that's your simplest mitigation.
3. Review proxy logs for FTP traffic patterns from unfamiliar or unexpected upstream servers.

1. Upgrade to Squid 7.6 or the Squid 8 branch immediately.
2. If you cannot patch right away, disable FTP support in your Squid configuration as an interim mitigation.
3. If your proxy serves a shared network (office, school, public Wi-Fi), treat any cleartext HTTP credentials that passed through it during the exposure window as potentially compromised.