DEBIAN-CVE-2026-119146: Buffer Overflow
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the modrewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/proftpd-dfsgto a version that resolves this vulnerability.Fixed in 1.3.9e~dfsg-1
Event History
Frequently Asked Questions
When can this be exploited without FTP credentials?
Unauthenticated exploitation is possible when pre-login FTP commands are subject to rewriting. An attacker can send an overlong FTP command argument before authentication in that configuration.
What configuration component is involved?
The affected code is the mod_rewrite int:utf8trans RewriteMap. Deployments using that RewriteMap should be reviewed, especially where it rewrites commands available before login.
How can I assess whether a server is potentially affected?
Check whether the installed ProFTPD version is before 1.3.9e or is 1.3.10rc5, and inspect the mod_rewrite configuration for use of the int:utf8trans RewriteMap. Also determine whether pre-login commands are rewritten, as that permits unauthenticated attack attempts.