{"id":"CVE-2026-119146","title":"ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap","summary":"ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 …","severity":"medium","cvss":5.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","cvssSource":"cna","cwe":["CWE-120"],"vendor":"ProFTPD Project","product":"ProFTPD","affected":["ProFTPD < 1.3.9e","ProFTPD >= 1.3.10rc1 < 1.3.10rc5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-04T02:05:08.464050Z"},"published":"2026-10-30","updated":"2026-11-04","sourceUpdated":"2026-11-04T02:05:17.438Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-119146","references":[{"url":"https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301"},{"url":"https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c#L2052"},{"url":"https://github.com/proftpd/proftpd/releases/tag/v1.3.9e","label":"ProFTPD v1.3.9e Release Notes"},{"url":"https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5","label":"ProFTPD v1.3.10rc5 Release Notes"},{"url":"https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans"},{"url":"https://github.com/proftpd/proftpd"},{"url":"https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mod-rewrite-utf8trans-rewritemap","label":"VulnCheck Advisory: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap"}],"tags":["cve.org"],"epss":0.00459,"epssPercentile":0.39911,"ingestedAt":"2026-11-03T10:42:03.635Z","slug":"CVE-2026-119146","body":"## Overview\n\nProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.\n\n## Affected\n\n- `ProFTPD < 1.3.9e`\n- `ProFTPD >= 1.3.10rc1 < 1.3.10rc5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":31,"depthScoreParts":{"impact":30.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}