CVE-2026-63090

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63090
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63090.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63090
Downstream
Published
2026-07-20T14:22:03.712Z
Modified
2026-07-23T03:56:25.793494662Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
Details

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the modsftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the rootfs BSS global pointer to reference a fake filesystem struct, and redirect prfsiostat() to system() via a crafted RENAME request.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63090.json",
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-122"
    ]
}
References

Affected packages

Git / github.com/proftpd/proftpd

Affected ranges

Type
GIT
Repo
https://github.com/proftpd/proftpd
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
78a1bea439969913d7002bfb16ee7f0f60e262b4
Introduced
df75a382880e68d8c0f252cf930a7d78c57a9f6f
Fixed
dbf20f70159ba62f840a9d4347569259b2ecfeba
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.9c"
        },
        {
            "introduced": "1.3.10rc1"
        },
        {
            "fixed": "1.3.10rc3"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.3.10rc1
v1.3.10rc2
v1.3.10rc2-2
v1.3.6
v1.3.6rc1
v1.3.6rc2
v1.3.6rc3
v1.3.6rc4
v1.3.7
v1.3.7rc1
v1.3.7rc2
v1.3.7rc3
v1.3.7rc4
v1.3.8
v1.3.8rc1
v1.3.8rc2
v1.3.8rc3
v1.3.8rc4
v1.3.9
v1.3.9a
v1.3.9b
v1.3.9rc1
v1.3.9rc2
v1.3.9rc3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63090.json"