Description
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.

Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Published: 2026-10-01
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Allows arbitrary outbound connections through the proxy
Action: Patch
AI Analysis

Impact

Improper validation of the FTP PASV reply address in mod_proxy_ftp for Apache HTTP Server versions up to 2.4.68 permits an untrusted upstream FTP server to instruct the forward proxy to open a data connection to any host specified in a crafted PASV response. This flaw is a CWE‑284 type access‑control weakness that can enable the attacker to cause the proxy to transmit data to a third‑party server, potentially exfiltrating data or serving as a foothold for subsequent attacks.

Affected Systems

Apache HTTP Server, all platforms, forward proxy configurations, versions through 2.4.68.

Risk and Exploitability

The vulnerability has no announced exploitation in the wild and is not listed in the CISA KEV catalog, with an EPSS score of <1%. However, it is exploitable when the attacker can control the FTP server the proxy connects to. By sending a forged PASV reply the attacker forces the proxy to initiate a TCP connection to an arbitrary host, which can be used for data exfiltration or to pivot to other systems. The CVSS score of 7.5 indicates a high severity level, and this capability to direct outbound connections to arbitrary addresses represents a significant risk in environments where the proxy has broad internet access.

Generated by OpenCVE AI on October 2, 2026 at 14:55 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Apache HTTP Server to version 2.4.69 or later.
  • If mod_proxy_ftp is not required, disable the module or remove it from the proxy configuration.
  • Configure firewall or proxy settings to restrict outbound connections from the proxy to a whitelist of approved hosts.

Generated by OpenCVE AI on October 2, 2026 at 14:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6569-1 apache2 security update
Ubuntu USN Ubuntu USN USN-8931-1 Apache HTTP Server vulnerabilities
History

Mon, 05 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Apache http Server
CPEs cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*
Vendors & Products Apache http Server

Fri, 02 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Redhat
Redhat hummingbird
Weaknesses CWE-918
CPEs cpe:/a:redhat:hummingbird:1
Vendors & Products Redhat
Redhat hummingbird
References
Metrics threat_severity

None

 threat_severity

Moderate

Thu, 01 Oct 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Apache
Apache apache Http Server
Vendors & Products Apache
Apache apache Http Server

Thu, 01 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
References

Thu, 01 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 01 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response. Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Title Apache HTTP Server: mod_proxy_ftp PASV address handling
Weaknesses CWE-284
References

Subscriptions

Apache Apache Http Server Http Server
Redhat Hummingbird
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-10-01T20:09:29.345Z

Reserved: 2026-07-15T07:09:43.751Z

Link: CVE-2026-63045

cve-icon Vulnrichment

Updated: 2026-10-01T20:09:29.345Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-01T17:17:29.680

Modified: 2026-10-05T13:15:35.283

Link: CVE-2026-63045

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-01T16:09:07Z

Links: CVE-2026-63045 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-02T15:00:13Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-918

    Server-Side Request Forgery (SSRF)