A 29-year-old vulnerability named SquidBleed was found in the Squid web proxy, and it allows attackers to leak plaintext HTTP requests. The bug lets an already authenticated client to use the proxy and trigger a heap over-read that spills out sensitive data, such as credentials and tokens. The exploit works by sending a specialized FTP directory listing that makes the proxy read past the end of a buffer and copy memory contents of another user's request. The issue was disclosed by researchers at Calif.io, and traced back to a 1997 FTP-parsing change. They noted that proof-of-concept code is public, no active exploitation has been reported yet. To mitigate the risk, administrators should upgrade to Squid 7.7+, or disable FTP support.