CVE-2026-119146 in ProFTPD
Summary
by MITRE • 10/30/2026
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The ProFTPD software suite, prior to versions 1.3.9e and 1.3.10rc5, contains a critical buffer overflow vulnerability within its mod_rewrite module, specifically affecting the int:utf8trans RewriteMap function. This flaw stems from insufficient bounds checking when processing FTP command arguments that exceed one kilobyte in length. The vulnerability is particularly severe because it can be exploited without authentication if pre-login commands are subject to rewriting rules configured by the system administrator. When an attacker sends a crafted FTP request with argument data exceeding the 1024-byte limit, the application fails to properly validate or truncate the input before copying it into static memory buffers. This lack of validation leads to a classic stack-based buffer overflow condition where excess data overwrites adjacent memory locations, corrupting the session state and potentially allowing for arbitrary code execution if further exploitation techniques are applied beyond simple denial of service.
From an operational perspective, this vulnerability poses a significant risk to the availability and integrity of FTP services relying on ProFTPD with mod_rewrite enabled. The immediate impact is often observed as a crash or termination of the affected session due to memory corruption. However, in more sophisticated attack scenarios, overwriting static buffers can alter control flow pointers such as return addresses or function pointers within the process heap or stack. This capability allows remote attackers to execute arbitrary commands on the underlying operating system with the privileges of the ProFTPD daemon. Since FTP servers often run with elevated permissions to facilitate file transfers, successful exploitation could lead to full compromise of the host machine, including access to sensitive data stored in accessible directories and potential pivoting into internal networks.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-120 Buffer Copy without Checking Size of Input Classic Buffer Overflow and CWE-787 Out-of-bounds Write. The exploitation vector is categorized under MITRE ATT&CK techniques related to Initial Access via Exploitation of Remote Services, specifically leveraging unauthenticated access if pre-login rewriting is active. It also touches upon CWE-20 Improper Input Validation, as the core failure lies in the application's inability to correctly assess and handle input length constraints before memory allocation or copying operations occur. The presence of this flaw highlights the dangers of complex configuration modules like mod_rewrite when they interact with network-facing protocols without rigorous security auditing.
Mitigation strategies primarily involve upgrading ProFTPD to version 1.3.9e or later, where these bounds checking mechanisms have been corrected. For environments unable to upgrade immediately, administrators should review their FTP server configurations and disable the int:utf8trans RewriteMap if it is not strictly necessary for business operations. Additionally, restricting access to pre-login commands through firewall rules or network segmentation can reduce the attack surface by preventing unauthenticated users from reaching the vulnerable code paths. Implementing strict input validation at any proxy layer in front of the FTP server may also help filter out oversized requests before they reach the application logic, although this is a compensatory control rather than a fix for the underlying software defect. Regular patch management and configuration reviews are essential to maintain the security posture of legacy or critical infrastructure services like ProFTPD.