Netware FTP Server Whitespace Handling Vulnerability (Squidbleed)

Ankit Mehta@Secvyn

•updated Jun 23, 2026•3•0•9

This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.