Live › vulnerability › CVE-2026-119146
ProFTPD's mod_rewrite int:utf8trans RewriteMap has a buffer overflow: FTP command arguments longer than 1024 bytes overwrite static buffers. An attacker can corrupt session memory and crash the session, and the sources do not say whether code execution is possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Only servers running ProFTPD with mod_rewrite configured with an int:utf8trans RewriteMap are exposed. The unauthenticated path requires pre-login commands to be rewritten, so default configurations without mod_rewrite are likely outside the risk. Teams that run ProFTPD without mod_rewrite can skip this.
No product ranges from the sources yet.
proftpd -v; affected builds are before 1.3.9e and before 1.3.10rc5.int:utf8trans RewriteMap, which the description requires.1.3.9e or later on the 1.3.9 line, or or later on the 1.3.10 line.1.3.10rc5Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
This page as .md · .json · in your agent: get_signal("CVE-2026-119146")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.