memory leak

A critical heap out-of-bounds read in Ollama's model loader lets unauthenticated attackers drain server memory in three API calls. Around 300,000 internet-facing instances are estimated at risk.

CVE-2026-47729 (Squidbleed) is a heap buffer overread in Squid Proxy's FTP parser, present since 1997, discovered by Anthropic's Claude Mythos Preview: it leaks users' HTTP credentials and session tokens in corporate and shared proxy environments.