Vulnerability record/PUBLISHED/Published Oct 30, 2026 11:30:35 UTC
CVE-2026-119146
ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.
Base score6.3/ 10
SeverityMediumCVSS 4.0
Exploitability / impact
CVSS metric breakdown
Base severityMedium
Attack vectorNetworkAV
Attack complexityHighAC
Attack requirementsPresentAT
Privileges requiredNonePR
User interactionNoneUI
Vulnerable system confidentialityLowVC
Vulnerable system integrityLowVI
Vulnerable system availabilityLowVA
Subsequent system confidentialityNoneSC
Subsequent system integrityNoneSI
Subsequent system availabilityNoneSA
CVSS vector string
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:NCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityVulnCheck
Last updatedNov 4, 2026 02:05:17 UTC
PublishedOct 30, 2026 11:30:35 UTC
ReservedOct 29, 2026 14:28:41 UTC
Credits
- Bruno Henc
- Abraxas Labs
- TJ Saunders