Log in Start free

Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119146ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap

Medium 5.6

In plain English

A medium-severity buffer overflow in ProFTPD from ProFTPD Project. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.6Medium
Exploit odds (30 days)0.5%top 60.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.23proftpd1.3.9e-r0ALPINE-CVE-2026-119146
Alpine:v3.24proftpd1.3.9e-r0ALPINE-CVE-2026-119146
Debian:12proftpd-dfsgno fix listedDEBIAN-CVE-2026-119146
Debian:13proftpd-dfsgno fix listedDEBIAN-CVE-2026-119146
Debian:14proftpd-dfsg1.3.9e~dfsg-1DEBIAN-CVE-2026-119146
Ubuntu:22.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119146
Ubuntu:24.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119146
Ubuntu:26.04:LTSproftpd-dfsgno fix listedUBUNTU-CVE-2026-119146
Ubuntu:26.10proftpd-dfsgno fix listedUBUNTU-CVE-2026-119146

Affected products (as reported)

VendorProductVersions
ProFTPD Project ProFTPD 0 – before 1.3.9e1.3.10rc1 – before 1.3.10rc5

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References