ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and forcing the server to read beyond the end of the SSH channel data and write overread process memory into the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable exploitation of memory corruption vulnerabilities in the same process.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The     fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without a     minimum sanity check. A value of 0 causes an unsigned subtraction elsewhere in the read path to underflow     to approximately 4 GB. That oversized request reaches the core memory allocator, where the rounded size is     computed in size_t but passed to new_block() as a 32-bit int; the low 32 bits of 0x100000000 are 0, so     new_block() returns a small (~512-byte) block while the caller is told it received ~4 GB. The subsequent     fill loop then streams attacker-controlled bytes past the end of the 544-byte allocation, producing an     attacker-controlled heap buffer overflow. An authenticated user can crash the per-connection ProFTPD     session child on demand with a single malformed SFTP packet (packet_len=0 followed by a body greater than     approximately 544 bytes), producing reliable authenticated remote denial of service. Depending on heap     layout and adjacent allocations, heap metadata corruption and further consequences beyond denial of     service may be possible, though only denial of service is demonstrated by the supplied proof of     concept.(CVE-2026-53994)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process.(CVE-2026-63091)

    ProFTPD before 1.3.9c and 1.3.10rc3 contains a heap-based buffer overflow vulnerability in the mod_sftp     module that allows authenticated low-privilege attackers to achieve arbitrary code execution by sending     crafted SFTP packet fragments exceeding the 16 KB reassembly buffer in the fxp.c component. Attackers can     supply oversized fragments to trigger an incorrectly conditioned reallocation, corrupt pool freelist     metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and redirect     pr_fsio_stat() to system() via a crafted RENAME request.(CVE-2026-63090)

Tenable has extracted the preceding description block directly from the EulerOS proftpd security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ProFTPD before 1.3.9c and 1.3.10rc3 contains a signed integer overflow vulnerability in the mod_sftp     module's SCP size-record parser that allows authenticated low-privilege attackers to bypass ASLR by     sending a crafted file size value of UINT64_MAX, which results in a negative off_t value. Attackers can     exploit the subsequent conversion to uint32_t, causing an approximately 4 GB requested read length and     forcing the server to read beyond the end of the SSH channel data and write overread process memory into     the uploaded file. In tested configurations, the disclosed data contains libc, libcrypto, and PIE pointers     sufficient to derive their randomized base addresses, thereby bypassing ASLR and enabling reliable     exploitation of memory corruption vulnerabilities in the same process. (CVE-2026-63091)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376761	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-4442)	Nessus	Huawei Local Security Checks	Local	high
376676	EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-4519)	Nessus	Huawei Local Security Checks	Local	high
365084	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4275)	Nessus	Huawei Local Security Checks	Local	high
364976	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4183)	Nessus	Huawei Local Security Checks	Local	high
364924	EulerOS 2.0 SP11 : proftpd (EulerOS-SA-2026-4365)	Nessus	Huawei Local Security Checks	Local	high
364775	EulerOS 2.0 SP13 : proftpd (EulerOS-SA-2026-4092)	Nessus	Huawei Local Security Checks	Local	high
328232	Linux Distros Unpatched Vulnerability : CVE-2026-63091	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-63091

high

Tenable Plugins

high

high

high

high

high

high

high