BIT-apache-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling

Q: Which deployments are exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are affected when mod_proxy_ftp is used in a forward proxy configuration. The issue applies on all platforms.

Q: What must an attacker control to exploit it?

An attacker needs to operate or control an untrusted FTP server that the forward proxy connects to. That FTP server can return a crafted PASV response that causes the proxy to open a data connection to an arbitrary third-party host.

Q: What should be done to remediate the issue?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the PASV reply address validation issue.

Published Oct 1, 2026

Updated

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.

Affected Software

1 affected component

Apache HTTP Server<=2.4.68

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache HTTP Server to a version that resolves this vulnerability.
Fixed in 2.4.69

Event History

Oct 1, 2026

CVE Published

via OSV·04:09 PM

Data Sourced

via OSV·04:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Apache HTTP Server deployments through 2.4.68 are affected when mod_proxy_ftp is used in a forward proxy configuration. The issue applies on all platforms.

What must an attacker control to exploit it?

An attacker needs to operate or control an untrusted FTP server that the forward proxy connects to. That FTP server can return a crafted PASV response that causes the proxy to open a data connection to an arbitrary third-party host.

What should be done to remediate the issue?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the PASV reply address validation issue.

BIT-apache-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to exploit it?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker control to exploit it?

What should be done to remediate the issue?