ALPINE-CVE-2026-119146: Buffer Overflow
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/proftpdto a version that resolves this vulnerability.Fixed in 1.3.9e-r0
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated attacks?
ProFTPD deployments running a version before 1.3.9e or 1.3.10rc5 are exposed when mod_rewrite rewrites pre-login FTP commands. In that configuration, an attacker does not need authentication.
What does an attacker need to send?
The attacker must send an FTP command argument longer than 1024 bytes that reaches the mod_rewrite int:utf8trans RewriteMap. Exploitation has high attack complexity and can corrupt session memory, including crashing the affected session.
How can I determine whether my service is affected?
Check the installed ProFTPD version and whether mod_rewrite is configured to apply the int:utf8trans RewriteMap to pre-login commands. Systems matching both conditions should be treated as affected.