DEBIAN-CVE-2026-119568: Critical severity debian/vsftpd vulnerability

Published Oct 30, 2026

Updated

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssldataaccept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

Affected Software

3 affected components

debian/vsftpd*

Event History

Oct 30, 2026

CVE Published

via OSV·12:16 PM

Data Sourced

via OSV·12:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Debian systems running vsftpd through 3.0.5 are affected when FTPS data connections are used. Exploitation specifically requires the attacker to share the victim's source IP address.

What does an attacker need to do to exploit it?

The attacker does not need prior authentication. They must obtain their own TLS session ticket using AUTH TLS, share the victim's source IP, and connect to the victim's passive-mode (PASV) data port.

What could an attacker do after exploiting the flaw?

An attacker can hijack an FTPS data connection, allowing them to steal downloaded content or inject data into uploads.

DEBIAN-CVE-2026-119568: Critical severity debian/vsftpd vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What could an attacker do after exploiting the flaw?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to do to exploit it?

What could an attacker do after exploiting the flaw?