'Squidbleed' Vulnerability Exposed: 29-Year-Old Squid Proxy Flaw Leaks Plaintext HTTP Requests

A security vulnerability lurking for approximately 29 years has been disclosed in the widely deployed Squid web proxy server software. Tracked as CVE-2026-47729 and dubbed 'Squidbleed' by researchers — a name deliberately evoking the infamous Heartbleed vulnerability — the flaw has drawn significant attention from the cybersecurity community.

Vulnerability Overview

According to reporting by The Hacker News, the vulnerability allows a user who has already been granted authorized access to a proxy server to extract fragments of other users' plaintext HTTP requests. Information potentially exposed includes:

• Usernames and passwords (credentials)
• Session tokens
• Other sensitive HTTP request content

The Squid project characterizes the issue as an attack originating from a "trusted client" — meaning the attacker is not an arbitrary host on the internet, but rather an internal user already permitted to use the proxy. This makes the vulnerability particularly relevant to corporate network environments where multiple users share a common proxy server.

AI-Assisted Discovery

Notably, the security researcher who reported the vulnerability highlighted that Anthropic's Claude Mythos Preview large language model played a significant role in the discovery process. The disclosure serves as another data point illustrating the growing practical value of AI tools in modern security research.

Scope and Impact

Squid is an open-source web proxy and caching software widely deployed across enterprise networks, academic institutions, and ISP (Internet Service Provider) infrastructure worldwide. The fact that this flaw has reportedly existed since approximately 1996 has alarmed the security community.

Squid administrators are strongly advised to monitor official security advisories and apply available patches promptly to mitigate risk.

Sources: Slashdot, The Hacker News

原文來源： 查看原文