Mythos discovers 'Squidbleed,' a memory leak thats gone undetected since Clinton
Security researchers at Mythos uncovered a memory leak vulnerability nicknamed 'Squidbleed' in the Squid web proxy software, which had remained undetected since the Clinton administration. The flaw potentially exposes sensitive data and affects a widely used open-source proxy.
Background
- Squid is a widely used open-source web proxy and cache server (not the squid sea creature or Amazon's AI). It sits between users and the internet, storing copies of frequently requested web content to speed up browsing.
- "Squidbleed" is a newly discovered memory leak vulnerability in Squid that has existed since the late 1990s (the "Clinton era"). A memory leak means the software fails to properly release memory after use, gradually consuming all available system memory until the server crashes or becomes unusable.
- Mythos is likely a security research team or individual that discovered and reported this vulnerability. The discovery is significant because Squid is deployed on countless enterprise networks, ISPs, and content delivery systems worldwide.
- Because the bug has been dormant for decades, it demonstrates how deeply embedded, subtle flaws can persist in widely trusted infrastructure software for years without detection. Users of Squid need to patch promptly to avoid denial-of-service conditions.