CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling
Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache HTTP Serverto a version that resolves this vulnerability.Fixed in 2.4.69
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue affects Apache HTTP Server through 2.4.68 when mod_proxy_ftp is used in a forward proxy configuration. It applies on all platforms.
What does an attacker need to exploit it?
An attacker needs to control or operate an untrusted FTP server that the forward proxy connects to. The FTP server can return a crafted PASV response that directs the proxy's data connection to an arbitrary third-party host.
What is the recommended remediation?
Upgrade Apache HTTP Server to version 2.4.69, which fixes the PASV reply address validation issue.