Squidbleed Vulnerability Exposes HTTP Requests in Squid 2.9 Proxy

Squid 2.9, a 29‑year‑old proxy server, has a newly discovered vulnerability dubbed Squidbleed that can leak the contents of HTTP requests to an attacker. The flaw was identified on July 10 2026 and is present in all releases of Squid 2.9, including the widely deployed 2.9.1 and 2.9.2 builds. When exploited, the bug allows an unauthenticated attacker to read request headers and body data, potentially exposing sensitive information such as authentication tokens and personal data. No official patch has been released yet, but the Squid developers have issued a temporary advisory recommending that users disable proxying or move to a newer major version. The vulnerability is classified as high‑severity and could affect hosting providers that rely on Squid for caching or load balancing. Affected operators should immediately audit their Squid configurations and consider upgrading to Squid 3.5 or later. The advisory also warns that the bug could be leveraged in combination with other network attacks to facilitate credential theft. Operators are urged to monitor security bulletins and apply any forthcoming patch as soon as it becomes available.