Squidbleed Vulnerability - Stack Variable Overflow Detection in FTP Parser

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•1

This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.