httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

EUVD-2026-106875

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681 Metasploit Framework FTP PASV Response SSRF

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

CVE-2026-109681

The Metasploit Framework FTP client is vulnerable to a Server-Side Request Forgery (SSRF) because it fails to validate the IP:port provided in the server's PASV response against the control connection target. A rogue FTP server can return an arbitrary IP:port in the 227 Passive Mode response, for...

PT-2026-120146

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

RHLW-2026-D10068B21671906A Lightwell Security Advisory: commons-net 3.8.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.8.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-C7216DB110A73995 Lightwell Security Advisory: commons-net 3.7.2.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.2.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-71F0BC56442456D3 Lightwell Security Advisory: commons-net 3.7.1.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.7.1.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-20F36034F30C7A24 Lightwell Security Advisory: commons-net 3.5.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.5.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-E16A7A7E33D1BD95 Lightwell Security Advisory: commons-net 3.6.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.6.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-94B9703160382A25 Lightwell Security Advisory: commons-net 3.4.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.4.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-CE8CAF53627ADA47 Lightwell Security Advisory: commons-net 3.2.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.2.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-B6AD3B6E26EC332F Lightwell Security Advisory: commons-net 3.3.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 3.3.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

RHLW-2026-93C3DAF552B9D6BC Lightwell Security Advisory: commons-net 2.0.0.rhlw-00001

Red Hat Lightwell has released commons-net:commons-net 2.0.0.rhlw-00001 with a backported security fix. CVE-2021-37533: Prior to Apache Commons Net 3.9.0, Net's FTP client trusts the host from PASV response by default. A malicious server can redirect the Commons Net code to use a different host,...

BIT-APACHE-2026-63045 Apache HTTP Server: mod_proxy_ftp PASV address handling

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

SUSE CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...