Description
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published: 2026-10-01
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Allows arbitrary outbound connections through the proxy
Action: Patch
AI Analysis

Impact

Improper validation of the FTP PASV reply address in mod_proxy_ftp for Apache HTTP Server versions up to 2.4.68 permits an untrusted upstream FTP server to instruct the forward proxy to open a data connection to any host specified in a crafted PASV response. This flaw is a CWE‑284 type access‑control weakness that can enable the attacker to cause the proxy to transmit data to a third‑party server, potentially exfiltrating data or serving as a foothold for subsequent attacks.

Affected Systems

Apache HTTP Server, all platforms, forward proxy configurations, versions through 2.4.68.

Risk and Exploitability

The vulnerability has no announced exploitation in the wild and is not listed in the CISA KEV catalog; EPSS is unavailable. However, it is exploitable when the attacker can control the FTP server the proxy connects to. By sending a forged PASV reply the attacker forces the proxy to initiate a TCP connection to an arbitrary host, which can be used for data exfiltration or to pivot to other systems. The CVSS score of 7.5 indicates a high severity level, and this capability to direct outbound connections to arbitrary addresses represents a significant risk in environments where the proxy has broad internet access.

Generated by OpenCVE AI on October 1, 2026 at 20:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or later.
  • If mod_proxy_ftp is not required, disable the module or remove it from the proxy configuration.
  • Configure firewall or proxy settings to restrict outbound connections from the proxy to a whitelist of approved hosts.

Generated by OpenCVE AI on October 1, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 01 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Http Server
Vendors & Products Apache
Apache apache Http Server

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Title Apache HTTP Server: mod_proxy_ftp PASV address handling
Weaknesses CWE-284
References

Subscriptions

Apache Apache Http Server
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T20:09:29.345Z

Reserved: 2026-07-15T07:09:43.751Z

Link: CVE-2026-63045

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:29.345Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-01T17:17:29.680

Modified: 2026-10-01T21:17:23.433

Link: CVE-2026-63045

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-01T22:00:14Z

Weaknesses