https://seclists.org/oss-sec/2026/q4/22: CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV addss handling

Q: Which deployments are exposed to this issue?

Only Apache HTTP Server deployments using mod_proxy_ftp in a forward proxy configuration are described as affected. The issue applies on all platforms to versions 2.4.0 through 2.4.68.

Q: What must an attacker control to exploit it?

An attacker needs to operate or control an untrusted FTP server that the forward proxy connects to. That server can send a crafted PASV response that causes the proxy to open a data connection to an arbitrary third-party host.

Q: What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue. The fix was released on 2026-10-01.

Published Oct 1, 2026

Updated

Affected Software

1 affected component

Apache HTTP Server>=2.4.0<=2.4.68

Frequently Asked Questions

Which deployments are exposed to this issue?

Only Apache HTTP Server deployments using mod_proxy_ftp in a forward proxy configuration are described as affected. The issue applies on all platforms to versions 2.4.0 through 2.4.68.

What must an attacker control to exploit it?

An attacker needs to operate or control an untrusted FTP server that the forward proxy connects to. That server can send a crafted PASV response that causes the proxy to open a data connection to an arbitrary third-party host.

What is the recommended remediation?

Upgrade Apache HTTP Server to version 2.4.69, which fixes the issue. The fix was released on 2026-10-01.