Description
ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect pr_fsio_stat() to system() via a crafted RENAME request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| proftpd | proftpd | < 1.3.9c, 1.3.10rc1 – < 1.3.10rc3 | 1.3.9c |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | proftpd-dfsg | 1.3.9c~dfsg-1 | — |
| Debian 13 | proftpd-dfsg | 1.3.8.c+dfsg-4+deb13u3 | — |
| Debian 12 | proftpd-dfsg | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | proftpd-dfsg | No fix yet | — |
| Ubuntu 26.04 LTS | proftpd-dfsg | No fix yet | — |
| Ubuntu 24.04 LTS | proftpd-dfsg | No fix yet | — |
| Ubuntu 22.04 LTS | proftpd-dfsg | No fix yet | — |
| Ubuntu 20.04 LTS | proftpd-dfsg | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | proftpd-dfsg | No fix yet | — |
| Ubuntu 16.04 LTS | proftpd-dfsg | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | proftpd | 1.3.8b-150600.13.18.1 | SUSE-SU-2026:5181-1 |
| SLES 15 SP6 | proftpd | 1.3.8b-150600.13.18.1 | SUSE-SU-2026:5181-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | proftpd | 1.3.8b-150600.13.18.1 | SUSE-SU-2026:5181-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | proftpd | 1.3.9e-2.1 | openSUSE-SU-2026:12517-1 |
Advisories 4
- openSUSE-SU-2026:12517-1 proftpd-1.3.9e-2.1 on GA media SUSE / openSUSE Security Updates · Nov 11, 2026
- SUSE-SU-2026:5181-1 Security update for proftpd SUSE / openSUSE Security Updates · Nov 11, 2026
- WID-SEC-2026-2424 ProFTPD: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3038 Meinberg LANTIME: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2026
References
- Release Notes release-notes
- ProFTPD 1.3.10rc3-3 Release Notes patch release-notes
- ProFTPD 1.3.9c Release Notes patch release-notes
- Pull Request issue-tracking
- Patch Commit patch
- https://www.vulncheck.com/advisories/proftpd-mod-sftp-heap-buffer-overflow-via-sftp-packet-reassembly third-party-advisory