ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of service may be possible, though only denial of service is demonstrated by the supplied proof of concept.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

    In ProFTPD through 1.3.9a before 7666224, a SQL injection vulnerability in sqltab_fetch_clients_cb() in     contrib/mod_wrap2_sql.c allows a remote attacker to inject arbitrary SQL commands via a crafted domain     name that is accessed in a reverse DNS lookup. When 'UseReverseDNS on' is enabled, the attacker-supplied     hostname is passed unescaped into SQL queries. The character restrictions of DNS names may affect     exploitability.(CVE-2026-44331)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of concept.
    (CVE-2026-53994)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
347241	EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3760)	Nessus	Huawei Local Security Checks	Local	high
347138	EulerOS 2.0 SP10 : proftpd (EulerOS-SA-2026-3713)	Nessus	Huawei Local Security Checks	Local	high
343634	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3373)	Nessus	Huawei Local Security Checks	Local	high
343619	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3298)	Nessus	Huawei Local Security Checks	Local	high
327905	Linux Distros Unpatched Vulnerability : CVE-2026-53994	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-53994

high

Tenable Plugins

high

high

high

high

high