CVE-2026-119146EUVD-2026-113779GHSA-WJ68-6748-262R
ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.3.9e, 1.3.10rc5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
ProFTPD, an FTP server, is affected when the mod_rewrite module's utf8trans RewriteMap is used. Remote attackers can send overly long FTP command arguments to overwrite memory and crash the server session.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- ProFTPD Project ProFTPD
fixed in 1.3.9e; From 1.3.10rc1 · fixed in 1.3.10rc5