Is CVE-2026-119146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119146 being exploited in the wild.

How severe is CVE-2026-119146?

Medium severity, with a CVSS score of 5.6, published 30 October 2026.

Which products and versions are affected?

Proftpd before 1.3.9e and before 1.3.10rc5.

Is there a fix for CVE-2026-119146?

Yes: fixed in 1.3.9e, 1.3.10rc5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119146 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-119146?

Check whether you run Proftpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119146: ProFTPD buffer overflow in mod_rewrite utf8trans

CVE-2026-119146 · Severity: medium · CVSS 5.6 · Published 2026-10-30

ProFTPD is an FTP server that handles file transfer operations. A buffer overflow vulnerability in the mod_rewrite module allows remote attackers to send malformed FTP commands that corrupt server memory and crash sessions. Without authentication requirements for pre-login commands, attackers can exploit this remotely.

Technologies: Proftpd. Vendors: Proftpd.

Quick answers

Is CVE-2026-119146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119146 being exploited in the wild.
How severe is CVE-2026-119146?: Medium severity, with a CVSS score of 5.6, published 30 October 2026.
Which products and versions are affected?: Proftpd before 1.3.9e and before 1.3.10rc5.
Is there a fix for CVE-2026-119146?: Yes: fixed in 1.3.9e, 1.3.10rc5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119146 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-119146?: Check whether you run Proftpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.3.9e, 1.3.10rc5

Technical details

A buffer overflow exists in the mod_rewrite int:utf8trans RewriteMap when processing FTP command arguments exceeding 1024 bytes. Remote attackers can trigger static buffer overwrites by sending oversized FTP commands, particularly on pre-login rewritten commands, to crash the FTP session or potentially corrupt session state.

Affected products

ProFTPD ProFTPD before 1.3.9e and before 1.3.10rc5

Timeline

2026-10-30: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.