OESA-2026-3231

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-3231
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-3231
Upstream
Published
2026-08-01T11:12:06Z
Modified
2026-08-18T01:21:27.765815730Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
proftpd security update
Details

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory visibility. This package defaults to the standalone behavior of ProFTPD, but all the needed scripts to have it run by systemd instead are included.

Security Fix(es):

ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in sizet but passed to newblock() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so newblock() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.(CVE-2026-53994)

ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the modsftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the rootfs BSS global pointer to reference a fake filesystem struct, and redirect prfsiostat() to system() via a crafted RENAME request.(CVE-2026-63090)

ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the modsftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64MAX, which results in a negative offt value. Attackers can exploit the subsequent conversion to uint32t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
proftpd

Package

Name
proftpd
Purl
pkg:rpm/openEuler/proftpd&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.8b-7.oe2003sp4

Ecosystem specific 

{
    "x86_64": [
        "proftpd-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-debuginfo-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-debugsource-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-devel-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-ldap-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-mysql-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-postgresql-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-sqlite-1.3.8b-7.oe2003sp4.x86_64.rpm",
        "proftpd-utils-1.3.8b-7.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "proftpd-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-debuginfo-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-debugsource-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-devel-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-ldap-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-mysql-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-postgresql-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-sqlite-1.3.8b-7.oe2003sp4.aarch64.rpm",
        "proftpd-utils-1.3.8b-7.oe2003sp4.aarch64.rpm"
    ],
    "src": [
        "proftpd-1.3.8b-7.oe2003sp4.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json"
openEuler:22.03-LTS-SP4
proftpd

Package

Name
proftpd
Purl
pkg:rpm/openEuler/proftpd&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.9a-3.oe2203sp4

Ecosystem specific 

{
    "x86_64": [
        "proftpd-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-devel-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2203sp4.x86_64.rpm",
        "proftpd-utils-1.3.9a-3.oe2203sp4.x86_64.rpm"
    ],
    "aarch64": [
        "proftpd-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-devel-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2203sp4.aarch64.rpm",
        "proftpd-utils-1.3.9a-3.oe2203sp4.aarch64.rpm"
    ],
    "src": [
        "proftpd-1.3.9a-3.oe2203sp4.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json"
openEuler:24.03-LTS-SP1
proftpd

Package

Name
proftpd
Purl
pkg:rpm/openEuler/proftpd&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.9a-3.oe2403sp1

Ecosystem specific 

{
    "x86_64": [
        "proftpd-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp1.x86_64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp1.x86_64.rpm"
    ],
    "aarch64": [
        "proftpd-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp1.aarch64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp1.aarch64.rpm"
    ],
    "src": [
        "proftpd-1.3.9a-3.oe2403sp1.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json"
openEuler:24.03-LTS-SP3
proftpd

Package

Name
proftpd
Purl
pkg:rpm/openEuler/proftpd&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.9a-3.oe2403sp3

Ecosystem specific 

{
    "x86_64": [
        "proftpd-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp3.x86_64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp3.x86_64.rpm"
    ],
    "aarch64": [
        "proftpd-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp3.aarch64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp3.aarch64.rpm"
    ],
    "src": [
        "proftpd-1.3.9a-3.oe2403sp3.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json"
openEuler:24.03-LTS-SP4
proftpd

Package

Name
proftpd
Purl
pkg:rpm/openEuler/proftpd&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.3.9a-3.oe2403sp4

Ecosystem specific 

{
    "x86_64": [
        "proftpd-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp4.x86_64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp4.x86_64.rpm"
    ],
    "aarch64": [
        "proftpd-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-debuginfo-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-debugsource-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-devel-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-ldap-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-mysql-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-postgresql-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-proxy-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-sqlite-1.3.9a-3.oe2403sp4.aarch64.rpm",
        "proftpd-utils-1.3.9a-3.oe2403sp4.aarch64.rpm"
    ],
    "src": [
        "proftpd-1.3.9a-3.oe2403sp4.src.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-3231.json"