{"id":"CVE-2026-119146","kind":"vulnerability","aliases":["CVE-2026-119146"],"related":[],"title":"ProFTPD: long FTP arguments overflow a buffer in mod_rewrite","description":"ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.","summary":"ProFTPD's mod_rewrite int:utf8trans RewriteMap has a buffer overflow: FTP command arguments longer than 1024 bytes overwrite static buffers. An attacker can corrupt session memory and crash the session, and the sources do not say whether code execution is possible.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ftp-server","proftpd","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-mod-rewrite","no-utf8trans-rewritemap"],"how_to_check":"- Check the installed version with `proftpd -v`; affected builds are before `1.3.9e` and before `1.3.10rc5`.\n- Check whether the configuration uses mod_rewrite with an `int:utf8trans` RewriteMap, which the description requires.\n- Check whether pre-login commands are rewritten, since that is the unauthenticated path.","fix":"- Move to `1.3.9e` or later on the 1.3.9 line, or `1.3.10rc5` or later on the 1.3.10 line.","status":"open","published_at":"2026-10-30T12:16:35+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","triaged_at":"2026-10-30T12:32:47+00:00","updated_at":"2026-10-30T12:32:47+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:47Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.3.9e` or later on the 1.3.9 line, or `1.3.10rc5` or later on the 1.3.10 line.","reach":"internet","title":"ProFTPD: long FTP arguments overflow a buffer in mod_rewrite","impact":"medium","summary":"ProFTPD's mod_rewrite int:utf8trans RewriteMap has a buffer overflow: FTP command arguments longer than 1024 bytes overwrite static buffers. An attacker can corrupt session memory and crash the session, and the sources do not say whether code execution is possible.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["proftpd","ftp-server","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"session memory corrupted and the FTP session crashes","analyst_note":"Confirm from the ProFTPD advisory whether code execution is possible beyond the crash and whether the pre-login path is exploitable in practice.","how_to_check":"- Check the installed version with `proftpd -v`; affected builds are before `1.3.9e` and before `1.3.10rc5`.\n- Check whether the configuration uses mod_rewrite with an `int:utf8trans` RewriteMap, which the description requires.\n- Check whether pre-login commands are rewritten, since that is the unauthenticated path.","plain_action":"","needs_analyst":true,"not_affected_if":["no-mod-rewrite","no-utf8trans-rewritemap","managed-hosting"],"who_is_affected":"Only servers running ProFTPD with mod_rewrite configured with an int:utf8trans RewriteMap are exposed. The unauthenticated path requires pre-login commands to be rewritten, so default configurations without mod_rewrite are likely outside the risk. Teams that run ProFTPD without mod_rewrite can skip this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000767,"input_tokens":4178,"output_tokens":698,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119146':13A,16A '-2026':12A,15A '1.3.10':72C '1.3.9':69C '1024':41B,102C 'allow':87C 'argument':4A,38B,99C 'attack':47B,89C,94C 'authent':105C 'buffer':7A,34B,45B,76C,93C 'byte':42B,103C 'code':63B 'command':37B,98C,110C 'contain':74C 'corrupt':49B,114C 'crash':53B,118C 'cve':11A,14A 'e':70C 'execut':64B 'ftp':3A,18B,36B,97C 'ftp-server':17B 'host':24B 'int':29B,83C 'login':109C 'long':2A 'longer':39B,100C 'memori':51B,116C 'mod':9A,27B,81C 'overflow':5A,35B,77C 'overwrit':43B,91C 'possibl':66B 'pre':108C 'pre-login':107C 'proftpd':1A,20B,25B,67C 'rc5':73C 'remot':88C 'rewrit':10A,28B,82C 'rewritemap':31B,85C 'rewritten':112C 'runtim':21B 'say':61B 'self':23B 'self-host':22B 'send':96C 'server':19B 'session':50B,55B,115C,120C 'sourc':58B 'static':44B,92C 'utf8trans':30B,84C 'vulner':78C 'whether':62B 'without':104C","nicknames":[],"mitigations":[],"who_affected":"Only servers running ProFTPD with mod_rewrite configured with an int:utf8trans RewriteMap are exposed. The unauthenticated path requires pre-login commands to be rewritten, so default configurations without mod_rewrite are likely outside the risk. Teams that run ProFTPD without mod_rewrite can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119146","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119146","severity":null,"published_at":"2026-10-30T12:16:35+00:00","modified_at":"2026-10-30T12:16:35+00:00","first_seen_at":"2026-10-30T12:30:22+00:00","fetched_at":"2026-10-30T12:30:22+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}