CVE-2026-119146
Received Received - Intake

Buffer Overflow in ProFTPD mod_rewrite UTF-8 Translation

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: VulnCheck

Description
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-119146
EUVD
EUVD-2026-113779

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ProFTPD Project ProFTPD 0
ProFTPD Project ProFTPD 1.3.10rc1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a buffer overflow in ProFTPD's mod_rewrite module, specifically in the int:utf8trans RewriteMap feature. It occurs when overly long FTP command arguments (over 1024 bytes) are processed before login, causing memory corruption and session crashes. The flaw allows remote attackers to overwrite static buffers without authentication if pre-login commands are rewritten.

Detection Guidance

To detect this vulnerability, check if ProFTPD is running a vulnerable version (before 1.3.9e or 1.3.10rc5) and if the mod_rewrite module with int:utf8trans RewriteMap is enabled. Inspect FTP server logs for crashes or session aborts during FTP command processing. Use network monitoring tools to detect unusually long FTP command arguments exceeding 1024 bytes.

Impact Analysis

This vulnerability can lead to denial-of-service conditions by crashing ProFTPD sessions. Attackers may exploit it to corrupt memory, causing the server to terminate unexpectedly. While remote code execution is not confirmed, the crash can disrupt FTP services and affect server availability.

Mitigation Strategies

Immediately update ProFTPD to version 1.3.9e or later. If updating is not possible, disable the mod_rewrite module or remove the int:utf8trans RewriteMap configuration. Restrict FTP access to trusted networks and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119146. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart