CVE-2026-119146: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap

Q: Which deployments can be reached without FTP credentials?

Unauthenticated exploitation is possible when pre-login FTP commands are subject to mod_rewrite rewriting. Otherwise, the provided information does not establish whether authentication is required.

Q: What input is needed to trigger the issue?

An attacker sends FTP command arguments longer than 1024 bytes that are processed by the mod_rewrite int:utf8trans RewriteMap. Successful triggering can corrupt session memory and crash the affected session.

Q: Which versions are affected and which versions contain the fix?

The issue affects ProFTPD versions before 1.3.9e and before 1.3.10rc5. Upgrading to 1.3.9e or 1.3.10rc5, as applicable to the release branch in use, addresses the stated vulnerable versions.

Published Oct 30, 2026

Updated

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

Affected Software

4 affected componentsFixes available

debian/proftpd-dfsg*

debian/proftpd-dfsg<=1.3.8+dfsg-4+deb12u5, <=1.3.8+dfsg-4+deb12u4, <=1.3.8.c+dfsg-4+deb13u3, <=1.3.9d~dfsg-1

1.3.9e~dfsg-2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/proftpd-dfsg to a version that resolves this vulnerability.
Fixed in 1.3.9e~dfsg-2

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·12:16 PM

Affected Software

Frequently Asked Questions

Which deployments can be reached without FTP credentials?

Unauthenticated exploitation is possible when pre-login FTP commands are subject to mod_rewrite rewriting. Otherwise, the provided information does not establish whether authentication is required.

What input is needed to trigger the issue?

An attacker sends FTP command arguments longer than 1024 bytes that are processed by the mod_rewrite int:utf8trans RewriteMap. Successful triggering can corrupt session memory and crash the affected session.

Which versions are affected and which versions contain the fix?

The issue affects ProFTPD versions before 1.3.9e and before 1.3.10rc5. Upgrading to 1.3.9e or 1.3.10rc5, as applicable to the release branch in use, addresses the stated vulnerable versions.

CVE-2026-119146: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments can be reached without FTP credentials?

What input is needed to trigger the issue?

Which versions are affected and which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments can be reached without FTP credentials?

What input is needed to trigger the issue?

Which versions are affected and which versions contain the fix?