Squidbleed Vulnerability - Timestamp-to-Filename Parsing Anomaly

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•4

Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.