AI Summary

A heap over‑read in the Squid web proxy can expose a user’s cleartext HTTP request, including credentials or session tokens, to anyone already permitted to send traffic through the same proxy. The vulnerability originates from a 1997 change to Squid’s FTP parsing. It remains active in Squid’s default configuration. The flaw allows an attacker with proxy access to read another user’s request data. No additional mitigation steps are described in the source.

AI summaries can be wrong sometimes—always verify important details using the source article.