Junglewise Threat Intelligence

CVE-2026-63090: ProFTPD heap overflow in mod_sftp

CVE-2026-63090 · Severity: high · CVSS 8.8 · Published 2026-07-20

Technologies: Proftpd. Vendors: Proftpd.

Executive brief

ProFTPD is a widely used file transfer server. A security flaw in its SFTP module allows a user with valid login credentials to crash the server or take full control of the underlying system. This could lead to unauthorized access to sensitive files, data theft, or a complete service outage.

Technical details

A heap-based buffer overflow exists in the mod_sftp module of ProFTPD within the fxp.c component. The vulnerability is caused by an incorrectly conditioned reallocation logic when reassembling fragmented SFTP packets that exceed the 16 KB buffer. An authenticated attacker can send oversized fragments to trigger this flaw, leading to pool freelist metadata corruption. By overwriting the root_fs BSS global pointer to point to a malicious filesystem structure, an attacker can redirect pr_fsio_stat() calls to system(), resulting in arbitrary code execution. The issue is fixed in versions 1.3.9c and 1.3.10rc3.

Affected products

  • ProFTPD ProFTPD < 1.3.9c, >= 1.3.10rc1 < 1.3.10rc3

Timeline

  • 2026-06-26: disclosed: Issue reported by Fabian Wahle of Hap Security
  • 2026-07-07: patched: Version 1.3.10rc3 released
  • 2026-07-08: patched: Version 1.3.9c released
  • 2026-07-20: advisory: NVD publication date

References