CVE-2026-63045
published 2026-10-01CVE-2026-63045: Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in…
PriorityP349high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.47%
39.9th percentile
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | http_server | >= 2.4.0 < 2.4.69 | 2.4.69 |
| apache | httpd | — | — |
| apache_software_foundation | apache_http_server | 2.4.0 – 2.4.68 | — |
| httpd_2.4 | httpd | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
vendor_redhat·2026-10-01·CVSS 7.5
CVE-2026-63045 [HIGH] CWE-918 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to esta
GHSA
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FT
ghsa_unreviewed·2026-10-01
CVE-2026-63045 [HIGH] CWE-284 Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FT
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response [fedora-all]
bugzilla·2026-10-02·CVSS 7.5
CVE-2026-63045 [HIGH] CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response [fedora-all]
CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Bugzilla
CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
bugzilla·2026-10-01·CVSS 7.5
CVE-2026-63045 [HIGH] CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
CVE-2026-63045 httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
2026-10-01
Published