Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Squid can read extra data or crash on FTP listings

published 3 months ago

Summary

The Oracle Squid proxy and its migration and init scripts may read beyond the intended memory area or overflow a buffer when processing certain FTP directory listings. This can lead to unexpected behavior or a crash, potentially disrupting service. Apply the latest security update from Oracle to fix the problem.

What to do

Update oracle squid to version 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7.
Update oracle squid-migration-script to version 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7.
Update oracle squid-sysvinit to version 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7.

Affected software

Ecosystem	Vendor	Product	Affected versions
TuxCare:OracleLinux:7	oracle	squid	< 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7 Fix: upgrade to 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7
TuxCare:OracleLinux:7	oracle	squid-migration-script	< 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7 Fix: upgrade to 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7
TuxCare:OracleLinux:7	oracle	squid-sysvinit	< 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7 Fix: upgrade to 7:3.5.20-17.0.5.el7_9.99.tuxcare.els7

Original advisory text

squid: Fix of 2 CVEs

- CVE-2026-47729: fix out-of-bounds read in FTP gateway directory-listing parser when a listing entry date is not followed by a filename
- CVE-2026-50012: fix heap buffer overflow in cache digest reply handling (peerDigestSwapInMask) by bounding mask data against the declared mask_size

References

https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1784805092.html Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-47729 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-50012 Vendor Advisory

Timeline

Published23 Jul 2026

Updated26 Oct 2026

First seen26 Oct 2026

Sources

CLSA-2026-1784805092 · OSV

Track software like this

Free during beta