httpd: httpd: unauthorized connection to arbitrary hosts via crafted FTP PASV response

A flaw was found in httpd. When configured as a forward proxy using the modproxyftp module, the server improperly validates the network address returned in a File Transfer Protocol FTP passive mode PASV response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing t...

Linux Distros Unpatched Vulnerability : CVE-2026-63045

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward...

CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045

The Apache HTTP Server (versions through 2.4.68 ) is vulnerable to an improper validation of the FTP PASV reply address within the mod_proxy_ftp module. When configured as a forward proxy, an untrusted FTP server can provide a crafted PASV response, forcing the proxy to establish a data connectio...

EUVD-2026-90901

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

CVE-2026-63045

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

Rocky Linux 8 [CIQ] Security Update: curl / curl-debuginfo / curl-debugsource / libcurl / etc Multiple Vulnerabilities (crlsa-2021_1610)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20211610 advisory. curl: FTP PASV command response can cause curl to connect to arbitrary host CVE-2020-8284 curl: Malicious FTP server can trigger stack overflow when...

CVE-2026-63045: Improper Access Control

Improper validation of FTP PASV reply address in modproxyftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafte...

AlmaLinux 9.2 [TuxCare] Security Update: wget (ALMALINUX9.2:CLSA-2026:1786488345)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786488345 advisory. - GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or ...

openSUSE 16 Security Update : wget (openSUSE-SU-2026:21665-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21665-1 advisory. Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. -...

Security update for wget (important)

openSUSE security update: security update for wget ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21665-1 Rating: important References: bsc1271033 bsc1271034 bsc1271035 bsc1271036 bsc1271320 bsc1272219 bsc1273449 Cross-References: CVE-2026-15146...

SUSE-SU-2026:23297-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

SUSE-SU-2026:23326-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

OPENSUSE-SU-2026:21665-1 Security update for wget

This update for wget fixes the following issues: Security issued fixed: - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread...

SUSE-SU-2026:3530-1 Security update for python310

This update for python310 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-3276: quadratic complexity in unicodedata.normalize can le...

SUSE-SU-2026:23163-1 Security update for wget

This update for wget fixes the following issues - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. - CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread bsc1271033. - CVE-2026-58470:...

SUSE SLES15 Security Update : wget (SUSE-SU-2026:3206-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3206-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery bsc1271320. -...

SUSE SLED15 / SLES15 Security Update : wget (SUSE-SU-2026:3148-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3148-1 advisory. - CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery...

DEBIAN-CVE-2026-15146

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...

CVE-2026-15146: Undefined Security Weakness

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server, or an HTTP server that redirects to an FTP URL, can exploit this behavior to redirect Wget’s data connection to an arbitrary IP address and port. This allows an...