Re: Squid CVE-2026-47729 and CVE-2026-50012

[Alan Coopersmith <alan.coopersmith () oracle com>]

On 6/15/26 04:26, Amos Jeffries wrote:
> On 12/06/2026 20:21, Amos Jeffries wrote:
> > Hi all,
> >
> > Squid 7.6 release contains fixes for and releases the embargo on 
> > CVE-2026-47729 and CVE-2026-50012.
>
> Apologies, this first one (CVE-2026-47729) embargo is over, but the fix will 
> actually be in Squid 7.7.

A blog was posted about it today:
https://blog.calif.io/p/squidbleed-cve-2026-47729

It says the root cause was a misunderstanding of what the C standard requires:
> strchr(w_space, '\0') returns non-NULL per C11 §7.24.5.2 (terminating NUL
> is part of the string). 

--
        -Alan Coopersmith-                 alan.coopersmith () oracle com
         Oracle Solaris Engineering - https://blogs.oracle.com/solaris