---
id: "CVE-2026-119568"
kind: "vulnerability"
aliases: ["CVE-2026-119568"]
title: "vsftpd: TLS session reuse lets attackers hijack FTPS data connections"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "vsftpd", "fixed": [], "affected": "<= 3.0.5", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ftp", "ftps", "linux", "runtime", "self-hosted", "tls", "vsftpd"]
not_affected_if: ["inetd-mode", "no-ftps", "other-ftp-server", "require_ssl_reuse-not-the-issue", "ssl_enable-no"]
published_at: "2026-10-30T12:16:44+00:00"
first_seen_at: "2026-10-30T12:30:27+00:00"
updated_at: "2026-10-30T12:32:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119568", "first_seen_at": "2026-10-30T12:30:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T12:32:54+00:00"}]
---

# vsftpd: TLS session reuse lets attackers hijack FTPS data connections

vsftpd through 3.0.5 only checks that the FTPS data connection resumed some TLS ticket it can decrypt, not the same control session. An unauthenticated attacker sharing the victim's source IP can resume their own ticket on the victim's PASV port to steal downloads or inject uploads. No upstream fix; latest release is 3.0.5. Public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:vsftpd affected <= 3.0.5 fixed ?

## How to check

- Run `vsftpd -v` (or your package manager) — every release up to and including 3.0.5 is affected; 3.0.5 is the latest upstream release.
- Check that your build has SSL and it is on: `grep -E '^(ssl_enable|listen|require_ssl_reuse)' /etc/vsftpd.conf` (also /etc/vsftpd/vsftpd.conf). Exposed per the researcher: ssl_enable=YES, standalone listen=YES (or listen_ipv6=YES), require_ssl_reuse=YES (the default). The stock upstream tarball compiles SSL out, but most distro packages compile it in.

## Timeline

- 2026-10-30T12:30:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119568
- 2026-10-30T12:32:54+00:00 analyst — NVD/VulnCheck CVE-2026-119568 from Abraxas Labs 12 Oct 2026 research (public PoC, repo abraxas/vsftpd-ssl-data-any-ticket linked from page, not fetched). Vendor page (security.appspot.com) lists 3.0.5 as latest, no advisory/fix: fix-status none. Researcher rates 7.4 (CVSS3.1, AC:H); VulnCheck 9.1 CVSS4. Exploitation in wild not reported. Mitigation ideas not vendor-sourced so left out; do NOT set require_ssl_reuse=NO (weakens further). Nothing marked verified: vendor page does not discuss the flaw. Check distro trackers (Debian/Fedora) for backports.

## Documents

- [advisory] vsftpd project page (latest release v3.0.5) https://security.appspot.com/vsftpd.html
- [advisory] VulnCheck advisory CVE-2026-119568 https://www.vulncheck.com/advisories/vsftpd-through-3.0.5-require-ssl-reuse-bypass-via-ftps-data-channel-hijacking
- [poc] Abraxas Labs: vsftpd FTPS data accepts any resumed ticket (analysis + PoC) https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket

## From the sources

vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_