Live › vulnerability › CVE-2026-119568
vsftpd through 3.0.5 only checks that the FTPS data connection resumed some TLS ticket it can decrypt, not the same control session. An unauthenticated attacker sharing the victim's source IP can resume their own ticket on the victim's PASV port to steal downloads or inject uploads. No upstream fix; latest release is 3.0.5. Public PoC.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Servers running vsftpd 3.0.5 or earlier with FTPS enabled (ssl_enable=YES) in standalone mode, including distro packages that compile in OpenSSL. An attacker who shares the victim's source IP (same NAT, office or shared host) can open their own AUTH TLS session with no login, then resume that ticket on the victim's passive data port to read a download or inject an upload. Plain-FTP-only servers, SFTP/other FTP servers and anyone with ssl_enable=NO can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| vsftpd | vendor | <= 3.0.5 | – |
vsftpd -v (or your package manager) — every release up to and including 3.0.5 is affected; 3.0.5 is the latest upstream release.grep -E '^(ssl_enable|listen|require_ssl_reuse)' /etc/vsftpd.conf (also /etc/vsftpd/vsftpd.conf). Exposed per the researcher: ssl_enable=YES, standalone listen=YES (or listen_ipv6=YES), require_ssl_reuse=YES (the default). The stock upstream tarball compiles SSL out, but most distro packages compile it in.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
This page as .md · .json · in your agent: get_signal("CVE-2026-119568")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.