CVE-2026-63091 proftpd CVE debrief

Who should care

Users of ProFTPD versions before 1.3.9c and 1.3.10rc3 should apply patches or mitigations to prevent exploitation of this vulnerability. This includes operators managing ProFTPD deployments, platform administrators responsible for maintaining system security, vulnerability management teams assessing risk and remediation efforts, and security teams monitoring for potential indicators of compromise. Compensating controls, such as monitoring and restricting access to the mod_sftp module, should be reviewed and implemented to prevent exploitation until patches can be applied.

Technical summary

The vulnerability exists in the mod_sftp module's SCP size-record parser. An attacker can send a crafted file size value of UINT64_MAX, causing a negative off_t value. The subsequent conversion to uint32_t results in an approximately 4 GB requested read length, forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. The disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it allows authenticated low-privilege attackers to bypass ASLR and potentially lead to memory corruption. System administrators should review and implement compensating controls, such as monitoring and restricting access to the mod_sftp module, to prevent exploitation until patches can be applied.

Recommended defensive actions

• Apply patches or updates to ProFTPD versions 1.3.9c or 1.3.10rc3
• Implement compensating controls, such as monitoring and restricting access to the mod_sftp module
• Conduct inventory checks to identify and update vulnerable systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record was published on 2026-07-20T15:16:45.363Z and has not been modified since then. The NVD entry is currently 7.1 HIGH. Limited information is available about the affected scope and vendor remediation. Users should verify the official CVE record and NVD entry for the most current details. The mod_sftp module's SCP size-record parser vulnerability allows authenticated low-privilege attackers to bypass ASLR. Evidence of exploitation in the wild is not currently available. However, defenders should monitor for suspicious activity and review system logs for potential indicators of compromise.

Official resources