AZL-111799: CVE-2026-119568 affecting package vsftpd 3.0.5-1

Q: Which deployments are exposed to this issue?

FTPS deployments using affected vsftpd versions are exposed when an attacker can share the same source IP address as a victim and can reach the victim's passive-mode data port.

Q: What must an attacker do to exploit the vulnerability?

The attacker first obtains a TLS session ticket through AUTH TLS, then resumes that ticket when connecting to the victim's PASV port. This can allow the attacker to hijack the FTPS data connection.

Q: What could an attacker gain from a successful hijack?

An attacker may steal data being downloaded through the victim's FTPS connection or inject data into uploads.

Published Oct 30, 2026

Updated

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

Affected Software

1 affected component

azure-linux/vsftpd<=3.0.5-1

Event History

Oct 30, 2026

Advisory Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-119568

Frequently Asked Questions

Which deployments are exposed to this issue?

FTPS deployments using affected vsftpd versions are exposed when an attacker can share the same source IP address as a victim and can reach the victim's passive-mode data port.

What must an attacker do to exploit the vulnerability?

The attacker first obtains a TLS session ticket through AUTH TLS, then resumes that ticket when connecting to the victim's PASV port. This can allow the attacker to hijack the FTPS data connection.

What could an attacker gain from a successful hijack?

An attacker may steal data being downloaded through the victim's FTPS connection or inject data into uploads.

AZL-111799: CVE-2026-119568 affecting package vsftpd 3.0.5-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?

What could an attacker gain from a successful hijack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to exploit the vulnerability?

What could an attacker gain from a successful hijack?