Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Squid34 can be tricked into reading data or crashing
published 3 months ago
Summary
The Squid34 proxy server may mishandle specially crafted FTP directory listings, causing it to read unexpected memory. It can also be forced to overflow its internal buffer when receiving a malformed cache digest response, which could lead to a crash. Update Squid34 to the latest version that includes the fixes.
What to do
- Update oracle squid34 to version 7:3.4.14-16.el6.tuxcare.els14.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:OracleLinux:6 | oracle | squid34 |
< 7:3.4.14-16.el6.tuxcare.els14 Fix: upgrade to 7:3.4.14-16.el6.tuxcare.els14
|
Original advisory text
squid34: Fix of 2 CVEs
- CVE-2026-47729: fix out-of-bounds read in FTP directory listing parsing when a TypeA/TypeB date is not followed by a filename
- CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared mask_size (heap buffer overflow)
- CVE-2026-50012: harden peerDigestSwapInMask against a cache digest reply whose on-the-wire size exceeds the declared mask_size (heap buffer overflow)
References
- https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1784725992.html Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-47729 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-50012 Vendor Advisory
Timeline
Published22 Jul 2026
Updated26 Oct 2026
First seen26 Oct 2026
Sources
CLSA-2026-1784725992 · OSV
Track software like this
Free during beta