“The Squid Team have been helpful and supportive during the process of reporting these issues. However, they are effectively understaffed, and simply do not have the resources to fix the discovered issues.”
Joshua Rogers reported 55 security bugs in Squid in 2021, including a stack buffer overflow in digest auth and use-after-frees in ESI. Two and a half years later, most remain unfixed. More than 2.5 million Squid instances sit on the internet, many at corporations and “VPN” sellers charging for privacy. Everyone uses the proxy and nobody pays for the patches.