# CVE-2026-119146: ProFTPD buffer overflow in mod_rewrite utf8trans

Source: https://junglewise.ai/threats/cve-2026-119146-proftpd-before-1-3-9e-and-1-3-10rc5-contains-a-buffer-overflow  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119146 · Severity: medium · CVSS 5.6 · Published 2026-10-30

ProFTPD is an FTP server that handles file transfer operations. A buffer overflow vulnerability in the mod_rewrite module allows remote attackers to send malformed FTP commands that corrupt server memory and crash sessions. Without authentication requirements for pre-login commands, attackers can exploit this remotely.

Technologies: [Proftpd](https://junglewise.ai/threats/technologies/proftpd). Vendors: [Proftpd](https://junglewise.ai/threats/vendors/proftpd).

## Quick answers

**Is CVE-2026-119146 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119146 being exploited in the wild.

**How severe is CVE-2026-119146?** Medium severity, with a CVSS score of 5.6, published 30 October 2026.

**Which products and versions are affected?** Proftpd before 1.3.9e and before 1.3.10rc5.

**Is there a fix for CVE-2026-119146?** Yes: fixed in 1.3.9e, 1.3.10rc5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-119146 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-119146?** Check whether you run Proftpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 1.3.9e, 1.3.10rc5

## Technical details

A buffer overflow exists in the mod_rewrite int:utf8trans RewriteMap when processing FTP command arguments exceeding 1024 bytes. Remote attackers can trigger static buffer overwrites by sending oversized FTP commands, particularly on pre-login rewritten commands, to crash the FTP session or potentially corrupt session state.

## Affected products

- ProFTPD ProFTPD before 1.3.9e and before 1.3.10rc5

## Timeline

- 2026-10-30: disclosed

## References

- [https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans](https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans)
- [https://github.com/proftpd/proftpd](https://github.com/proftpd/proftpd)

## Related threats

- [ProFTPD mod_copy symlink traversal in SITE COPY](https://junglewise.ai/threats/cve-2026-119364-proftpd-through-1-3-9e-and-1-3-10rc1-through-1-3-10rc4-contains)
- [ProFTPD improper access control in SITE commands](https://junglewise.ai/threats/cve-2015-3306-proftpd-improper-access-control-vulnerability)
- [ProFTPD mod_sql SQL injection in logging pipeline](https://junglewise.ai/threats/cve-2026-42167-proftpd-mod-sql-sql-injection-in-logging-pipeline)
- [ProFTPD malicious backdoor in source distribution](https://junglewise.ai/threats/cve-2010-20103-proftpd-malicious-backdoor-in-source-distribution)