EUVD-2026-45396Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 18, 2026
Authenticated remote denial of service in ProFTPD's mod_sftp module allows any user with valid SFTP credentials to crash the per-connection server child with a single malformed packet. The flaw stems from an unsigned integer underflow and a size_t-to-int truncation that fools the allocator into returning a ~512-byte block while the caller believes it received ~4 GB, causing an attacker-controlled heap overflow past a 544-byte allocation. Publicly available exploit code exists (a VulnCheck proof of concept) demonstrating reliable DoS; heap metadata corruption and consequences beyond DoS are theorized but not demonstrated, and there is no public exploit identified for code execution.
Earlier versions of this analysis (1)
Authenticated denial of service in ProFTPD's mod_sftp module lets any user with valid SFTP credentials crash their per-connection session child on demand by sending a single malformed SFTP packet with a declared length of zero. The bug is a heap buffer overflow caused by an unsigned integer underflow (~4 GB) that is then truncated to a 32-bit int in the allocator, so a ~512-byte block is returned while ~4 GB of attacker-controlled bytes are streamed into it. A proof of concept demonstrating the DoS exists (VulnCheck); heap metadata corruption and impact beyond DoS are theorized but not demonstrated. No public evidence of active exploitation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Proftpd gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Reliable single-packet crash gives AC:L and A:H; authenticated SFTP account required so PR:L; only DoS is demonstrated so C:N/I:N.
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.
Executive ViewAI
ProFTPD SFTP service availability is at risk from a vulnerability allowing any authenticated user to trigger server crashes through malformed packets. Organizations depending on ProFTPD for file transfer operations must patch promptly to prevent service disruption and maintain operational continuity. Publicly documented proof-of-concept code is available.
Within 24 hours, inventory all ProFTPD installations with mod_sftp enabled and assess risk exposure by reviewing which user accounts have SFTP access, particularly external users. Within 7 days, apply the vendor-released patch to all affected systems; if immediate patching is not feasible, implement network access restrictions limiting SFTP connections to trusted clients or enable connection rate limiting as interim mitigation. Within 30 days, confirm patch deployment across all systems, monitor SFTP service stability, and review access logs for evidence of exploitation or suspicious connection patterns.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and informatio
SQL injection escalating to remote code execution in ProFTPD's mod_sql before 1.3.10rc1 lets remote attackers inject SQL
SQL injection in ProFTPD 1.3.9a and earlier allows remote attackers to execute arbitrary SQL commands when the 'UseRever
make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandl
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handl
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of serv
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. Rated high severi
Arbitrary code execution in ProFTPD's mod_sftp module (versions before 1.3.9c and 1.3.10rc3) allows authenticated low-pr
Directory ACL bypass in ProFTPD (through 1.3.9b and 1.3.10rc2) lets authenticated FTP users reach files inside DenyAll-p
The mod_tls module in ProFTPD before 1.3.5b and 1.3.6 before 1.3.6rc2 does not properly handle the TLSDHParamFile direct
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise High Performance Computing 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Server 15 SP7 | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP7 | Affected |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6 | Affected |
| SUSE Linux Enterprise Server 15 SP6-LTSS | Affected |
| SUSE Linux Enterprise Server for SAP Applications 15 SP6 | Affected |
| SUSE Linux Enterprise High Performance Computing 15 SP6 | Affected |
| openSUSE Leap 15.6 | Affected |
Exploit-DB