---
id: "CVE-2026-119146"
kind: "vulnerability"
aliases: ["CVE-2026-119146"]
title: "ProFTPD: long FTP arguments overflow a buffer in mod_rewrite"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ftp-server", "proftpd", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-mod-rewrite", "no-utf8trans-rewritemap"]
published_at: "2026-10-30T12:16:35+00:00"
first_seen_at: "2026-10-30T12:30:22+00:00"
updated_at: "2026-10-30T12:32:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119146", "first_seen_at": "2026-10-30T12:30:22+00:00"}]
---

# ProFTPD: long FTP arguments overflow a buffer in mod_rewrite

ProFTPD's mod_rewrite int:utf8trans RewriteMap has a buffer overflow: FTP command arguments longer than 1024 bytes overwrite static buffers. An attacker can corrupt session memory and crash the session, and the sources do not say whether code execution is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `proftpd -v`; affected builds are before `1.3.9e` and before `1.3.10rc5`.
- Check whether the configuration uses mod_rewrite with an `int:utf8trans` RewriteMap, which the description requires.
- Check whether pre-login commands are rewritten, since that is the unauthenticated path.

## Fix

- Move to `1.3.9e` or later on the 1.3.9 line, or `1.3.10rc5` or later on the 1.3.10 line.

## Timeline

- 2026-10-30T12:30:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119146

## From the sources

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_