CVE-2026-119146

    Dashboard / Vulnerabilities / CVE-2026-119146

    CVE-2026-119146

    Published: 30 Oct 2026Last Modified: 10 Nov 2026

    Summary: ProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap

    Details: ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnerability in the mod_rewrite int:utf8trans RewriteMap that allows remote attackers to overwrite static buffers. Attackers can send FTP command arguments longer than 1024 bytes, without authentication if pre-login commands are rewritten, to corrupt session memory and crash the session.

    References: https://abraxaslabs.tech/research/proftpd-rewrite-utf8trans, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119146.json, https://github.com/proftpd/proftpd/releases/tag/v1.3.10rc5, https://github.com/proftpd/proftpd/releases/tag/v1.3.9e, https://nvd.nist.gov/vuln/detail/CVE-2026-119146, https://www.vulncheck.com/advisories/proftpd-before-1.3-9e-and-1.3-10rc5-buffer-overflow-via-mod-rewrite-utf8trans-rewritemap, https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301, https://github.com/proftpd/proftpd, https://github.com/proftpd/proftpd/blob/v1.3.9d/contrib/mod_rewrite.c#L2052

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -fc3f908a0d07fa3b17fbe1e3054b7520806bc75a

    Affected versions

    v1.3.9d
    v1.3.10rc4
    v1.3.9c
    v1.3.10rc3-3
    v1.3.10rc3-2
    v1.3.10rc3
    v1.3.9b
    v1.3.10rc2-2
    v1.3.10rc2
    v1.3.9a
    v1.3.10rc1
    v1.3.9
    v1.3.9rc3
    v1.3.9rc2
    v1.3.9rc1
    v1.3.8
    v1.3.8rc4
    v1.3.8rc3
    v1.3.8rc2
    v1.3.8rc1
    v1.3.7
    v1.3.7rc4
    v1.3.7rc3
    v1.3.7rc2
    v1.3.7rc1
    v1.3.6
    v1.3.6rc4
    v1.3.6rc3
    v1.3.6rc2
    v1.3.6rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-119146 | CVE-DB