CVE-2026-53994: 
NixOS vulnerability analysis and mitigation

CVE-2026-53994 is a heap-based buffer overflow vulnerability in ProFTPD's mod_sftp module, specifically in the fxp_packet_read() function, exploitable by any authenticated SFTP user. It affects all ProFTPD versions prior to 1.3.10 (with the fix included in the 1.3.9 release). The vulnerability was published on July 18, 2026, and is assigned a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.7 (High) (Github Advisory, VulnCheck).

The root cause is a combination of integer underflow (CWE-191) and heap-based buffer overflow (CWE-122). The fxp_packet_read() function in mod_sftp accepts an attacker-supplied 32-bit big-endian SFTP packet length field without a minimum sanity check. When a packet length of 0 is supplied, an unsigned subtraction in the read path underflows to approximately 4 GB. This oversized value is passed to the core memory allocator, where the rounded size is computed as a size_t but then truncated to a 32-bit integer when passed to new_block(); the low 32 bits of 0x100000000 are 0, so new_block() returns a small (~512-byte) block while the caller believes it received ~4 GB. The subsequent fill loop then writes attacker-controlled bytes beyond the end of the ~544-byte allocation, producing an attacker-controlled heap buffer overflow (Github Advisory, VulnCheck). Exploitation requires only a valid SFTP authentication credential; no elevated privileges or special configuration are needed beyond having mod_sftp enabled.

The primary demonstrated impact is reliable authenticated remote denial of service: a single malformed SFTP packet (with packet_len=0 followed by a body exceeding ~544 bytes) crashes the per-connection ProFTPD session child process on demand. Depending on heap layout and adjacent allocations at the time of exploitation, heap metadata corruption could potentially enable consequences beyond denial of service, including possible code execution, though this has not been demonstrated by the published proof of concept (Github Advisory, bugzilla.redhat.com). The impact is scoped to the individual session child process; the main ProFTPD daemon is not directly terminated, but repeated exploitation can disrupt service availability for all SFTP users.

A proof-of-concept demonstrating denial of service was referenced at the time of disclosure, though no public exploit code has been confirmed as widely available (VulnCheck). There is no evidence of in-the-wild exploitation or threat actor attribution as of the time of reporting. The EPSS score is approximately 0.40%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" (Github Advisory).

1. Authenticate to the target: Obtain valid SFTP credentials for the target ProFTPD server running a vulnerable version (< 1.3.10) with mod_sftp enabled.
2. Establish an SFTP session: Connect to the server using any SFTP client or custom tool capable of sending raw SFTP protocol packets.
3. Craft a malformed SFTP packet: Construct an SFTP packet with the 32-bit big-endian length field set to 0x00000000 (zero), followed by a body of more than approximately 544 bytes of attacker-controlled data.
4. Send the malformed packet: Transmit the crafted packet over the established SFTP session. The fxp_packet_read() function will process the zero-length field, triggering the integer underflow and subsequent heap buffer overflow.
5. Observe session crash (DoS): The per-connection ProFTPD child process crashes due to heap corruption, terminating the SFTP session. Repeated sending can disrupt service for all users.
6. Potential further exploitation: Depending on heap layout, an attacker may attempt to control heap metadata corruption for code execution, though this requires additional heap grooming and has not been publicly demonstrated (Github Advisory, VulnCheck).

• Logs: Repeated unexpected termination of ProFTPD child processes in system logs (e.g., syslog, auth.log, or ProFTPD's TransferLog/SystemLog) shortly after SFTP authentication events from the same source IP.
• Logs: ProFTPD error log entries indicating segmentation faults, heap corruption errors, or abnormal process exits associated with SFTP sessions.
• Network: SFTP sessions from a single source IP that connect, authenticate, and then immediately disconnect or cause a server-side error, especially if repeated in rapid succession.
• Process: Unexpected termination of proftpd child processes (observable via process monitoring or core dump files) correlated with active SFTP connections.
• File System: Presence of core dump files in the ProFTPD working directory or system core dump location, generated by crashed proftpd child processes.

Upgrade ProFTPD to version 1.3.9 or later, which includes the fix committed in commit 7342836; all versions prior to 1.3.10 are considered vulnerable (Github Advisory, VulnCheck). As a workaround where patching is not immediately possible, restrict SFTP access to only trusted, known-good authenticated users and consider disabling mod_sftp if SFTP functionality is not required. Additionally, enabling heap hardening measures (e.g., ASLR, heap canaries) on the host system can reduce the risk of exploitation beyond denial of service. Monitor ProFTPD processes for unexpected crashes as an indicator of exploitation attempts.

Red Hat opened a Bugzilla tracking entry (Bug 2502098) classifying the vulnerability as high severity and tracking affected packages (bugzilla.redhat.com). VulnCheck, the CVE assigning authority for this issue, published a detailed advisory describing the technical mechanics of the overflow chain (VulnCheck). Social media activity was limited to automated CVE notification accounts and security aggregators shortly after disclosure, with no notable independent researcher commentary identified.