{"id":"CVE-2026-63045","published":"2026-10-01T17:17:29.680","lastModified":"2026-10-05T13:15:35.283","description":"Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwes":["CWE-284"],"vendors":["apache"],"products":["http server"],"references":[{"url":"https://httpd.apache.org/security/vulnerabilities_24.html","tags":["Vendor Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2026/10/01/23","tags":["Mailing List","Third Party Advisory"]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The flaw allows an untrusted FTP server to trick the Apache HTTP Server proxy into connecting to any third-party host, potentially enabling man-in-the-middle attacks or data exfiltration. This affects forward proxy configurations where the server acts as a gateway for FTP traffic.","exploitability":"Exploitation requires a malicious FTP server to craft a specific PASV response that tricks the proxy into opening a data connection to an arbitrary host, with no additional preconditions needed beyond the proxy being configured in forward mode.","blast_radius":"In a typical deployment, this could allow attackers to redirect FTP data connections to external hosts, potentially enabling them to intercept or manipulate FTP traffic between internal clients and external FTP servers.","remediation":"Upgrade to Apache HTTP Server version 2.4.69 which fixes this issue.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["proxy","ftp","network"],"model":"garnet-coder","analyzedAt":"2026-10-13T09:04:25.458Z"}}