Summary
Security researcher Joshua Rogers has disclosed “Squidbleed” (CVE-2026-47729), a memory leak vulnerability in the Squid web proxy that has existed in the codebase since 1997 — making it 29 years old. The flaw allows attackers to extract sensitive HTTP data from Squid’s memory, including user credentials, authentication tokens, session cookies, and other request data flowing through the proxy.
The vulnerability stems from a logic error in Squid’s request processing pipeline that can cause the proxy to leak portions of its heap memory in certain edge cases. The issue is particularly dangerous in enterprise environments where Squid serves as a forward or reverse proxy handling authenticated traffic at scale. An attacker with the ability to send crafted requests through an affected proxy can trigger memory disclosure without any authentication.
A patch was released in Squid version 7.6, published in June 2026. OpenAI’s GPT-5.5-Cyber reportedly assisted in identifying the root cause of the flaw, marking another case where AI tooling has accelerated vulnerability research in legacy codebases.
Sources
- Security Affairs — Squidbleed: 29-year-old Squid bug leaks user credentials
- The Hacker News — OpenAI expands Daybreak with GPT-5.5-Cyber
Commentary
A 29-year-old memory leak in one of the internet’s most widely deployed proxy servers is the kind of finding that should make every infrastructure team uncomfortable. Squid sits in front of enormous volumes of authenticated traffic at ISPs, enterprises, and CDN edges worldwide. If you’ve been running Squid in any capacity where it handles sensitive HTTP traffic, you should assume that credential material has been at risk for nearly three decades.
The AI angle here is worth noting too — GPT-5.5-Cyber helping pin down a bug that humans missed for 29 years is a compelling proof point for AI-assisted vulnerability research. Legacy codebases are full of subtle logic errors that are invisible to human reviewers doing spot checks but tractable for models that can reason across millions of lines of code. Expect more of these “ancient bug, AI-discovered” stories as researchers point frontier models at old but critical infrastructure.