Squidbleed (CVE‑2026‑47729) Lets Any Co‑user Peek Cleartext HTTP Data
A 29‑year‑old heap over‑read in Squid’s FTP parser (CVE‑2026‑47729) can spill another user’s cleartext HTTP requests, credentials, and session tokens to anyone sharing the same proxy. The flaw survives default configurations, exposing multi‑tenant environments like schools and corporate networks that still run Squid.