ProFTPD CVE-2026-119146

Exploitation requires that the mod_rewrite module is loaded AND a RewriteMap is defined using the internal int:utf8trans function AND a RewriteRule applies that map to FTP command arguments - this is a non-default configuration. The concrete trigger is an FTP command argument whose key exceeds the static utf8_val buffer size (the description cites arguments longer than 1024 bytes), which the vendor fix now rejects. LIMITING FACTORS: unauthenticated exploitation is possible only when pre-login commands are rewritten by such a rule; otherwise the attacker must be able to reach a rewritten (likely post-login) command, and the overall path depends on this specific mod_rewrite utf8trans setup (reflected by AC:H and AT:P). Impact is limited to session memory corruption and crashing the affected session.

This is a moderate-priority, configuration-dependent issue rather than a widespread emergency. The input CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L, 6.3) tells a consistent story: network-reachable and nominally unauthenticated (PR:N), but with high attack complexity (AC:H) and a present attack requirement (AT:P), and only Low impact to confidentiality, integrity and availability. Those Low impacts match the description, which states the outcome is static-buffer overwrite, session-memory corruption and a session crash - effectively a per-session denial of service and memory corruption, not confirmed remote code execution. The PR:N rating is real only in a non-default scenario (pre-login commands being rewritten); the AC:H/AT:P metrics reflect that exploitation depends on a specific mod_rewrite int:utf8trans configuration. No EPSS score and no KEV status were provided in the input, and the issue is not listed as actively exploited; the vuln.today decision label is 'this_month' (not act_now/emergency), so the signals align on 'patch in the normal cycle,' not 'drop everything.' No confirmed working exploit code is listed, though a public technical research writeup (abraxaslabs) and a VulnCheck advisory exist. Conflicting/missing-data note: the 'unauthenticated' property is conditional in the description ('without authentication if pre-login commands are rewritten') - verify whether your deployment actually rewrites pre-login commands before treating this as a pre-auth risk.

An attacker connects to an internet-facing ProFTPD server whose mod_rewrite is configured with an int:utf8trans RewriteMap applied to command arguments, and sends an FTP command argument longer than 1024 bytes. The oversized key overflows a static buffer in mod_rewrite.c, corrupting session memory and crashing the session; if pre-login commands are rewritten, this requires no authentication. A public technical research writeup describes the flaw, but no confirmed working exploit code is listed, and the AC:H/AT:P metrics reflect that it only works against this specific non-default configuration.