CVE-2026-119568: vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Other sources
vsftpd through 3.0.5 requiresslreuse Bypass via FTPS Data Channel Hijacking
— Microsoft
Event History
Frequently Asked Questions
Which deployments are exposed to this attack?
vsftpd versions through 3.0.5 are affected when FTPS data connections are in use. Exploitation requires the attacker to share the victim's source IP address.
What does an attacker need to do to exploit the issue?
The attacker must first obtain their own TLS session ticket using AUTH TLS, then connect to the victim's passive-mode (PASV) data port. They can use their ticket to bypass the intended TLS session reuse check for the victim's data connection.
What can an attacker do after hijacking a data connection?
An attacker can steal data being downloaded by the victim or inject data into uploads. The issue does not claim an impact on availability.