CVE-2026-63090: 
NixOS vulnerability analysis and mitigation

CVE-2026-63090 is a heap-based buffer overflow vulnerability in ProFTPD's mod_sftp module that allows authenticated low-privilege attackers to achieve remote code execution. It was disclosed on July 20, 2026, and affects all ProFTPD versions before 1.3.9c and 1.3.10rc1 through 1.3.10rc2 (fixed in 1.3.10rc3). The vulnerability was discovered by Fabian Wahle of Hap Security and assigned by VulnCheck. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, VulnCheck Advisory).

The root cause is an incorrectly conditioned reallocation in contrib/mod_sftp/fxp.c (CWE-122: Heap-based Buffer Overflow). When assembling fragmented SFTP packets, the code at fxp.c:3327 computes the required larger buffer size but only performs reallocation inside the unrelated fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ branch at fxp.c:3329; the subsequent append at fxp.c:3371 then writes past the end of curr_buf, overflowing the 16 KB reassembly buffer (GitHub Issue #2190). An attacker first sends an incomplete SFTP request to partially populate the packet buffer, then sends a follow-up channel chunk where curr_buflen + datalen exceeds the allocated buffer size. This overflow can corrupt pool freelist metadata, overwrite the root_fs BSS global pointer to reference a fake filesystem struct, and ultimately redirect pr_fsio_stat() to system() via a crafted SFTP RENAME request (VulnCheck Advisory, GitHub Commit).

Successful exploitation grants an authenticated low-privilege attacker arbitrary code execution with the privileges of the ProFTPD process, resulting in full compromise of confidentiality, integrity, and availability of the affected server. An attacker could read or exfiltrate sensitive files, modify or delete data, install backdoors, or use the compromised server as a pivot point for lateral movement within the network. The NVD SSVC assessment classifies the technical impact as "total" (GitHub Advisory, VulnCheck Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The NVD SSVC assessment notes exploitation is "none" and the vulnerability is not automatable, as it requires a valid authenticated session. The EPSS score is approximately 0.46%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection is available via Tenable Nessus plugin 328294 (Tenable).

1. Authenticate to the target: Obtain valid low-privilege SFTP credentials for a ProFTPD server running a vulnerable version (before 1.3.9c or 1.3.10rc1–rc2 with mod_sftp enabled).
2. Send an incomplete SFTP request fragment: Initiate an SFTP session and send a crafted, incomplete SFTP request that partially fills the mod_sftp packet reassembly buffer (curr_buf, default 16 KB) in fxp.c.
3. Trigger the buffer overflow: Send a follow-up SSH channel data chunk sized so that curr_buflen + datalen exceeds the currently allocated buffer. Because the reallocation logic is gated on an unrelated condition (fxp_packet_data_allocsz > FXP_PACKET_DATA_ALLOC_MAX_SZ), the buffer is not resized before the append at fxp.c:3371, causing a heap-based out-of-bounds write.
4. Corrupt heap metadata: Craft the oversized fragment payload to overwrite pool freelist metadata adjacent to curr_buf on the heap, enabling controlled memory corruption.
5. Overwrite root_fs global pointer: Leverage the heap corruption to overwrite the root_fs BSS global pointer with a reference to an attacker-controlled fake filesystem struct.
6. Redirect execution to system(): Send a crafted SFTP RENAME request that causes pr_fsio_stat() to be called via the fake filesystem struct's function pointer, which has been redirected to system(), executing an attacker-supplied command with ProFTPD process privileges (GitHub Issue #2190, VulnCheck Advisory).

• Network: Unusual or malformed SFTP channel data packets sent in rapid succession from a single authenticated client; SFTP sessions that send oversized or fragmented packet sequences inconsistent with normal file transfer behavior.
• Logs: ProFTPD SFTP log entries showing unexpected disconnections or errors from mod_sftp during packet reassembly; log messages referencing "renewing SFTP packet data pool" at abnormal frequency (patched versions also log "received excessive SFTP data" and disconnect).
• Process: Unexpected child processes spawned by the ProFTPD process (e.g., /bin/sh, bash, curl, wget) following an SFTP session; unusual outbound network connections originating from the ProFTPD process.
• File System: New or modified files in ProFTPD's working directory or system directories created by the ProFTPD service account; unexpected cron jobs, SSH authorized keys, or scripts added post-session.

Upgrade ProFTPD to version 1.3.9c (stable branch) or 1.3.10rc3 or later (development branch), both of which contain the fix for Issue #2190 (ProFTPD v1.3.9c Release, ProFTPD v1.3.10rc3 Release). The patch in commit 4ee8701 corrects the reallocation logic to always allocate sufficient space before appending, adds a sanity check that disconnects clients sending data exceeding FXP_MAX_PACKET_LEN, and increases FXP_PACKET_DATA_ALLOC_MAX_SZ from 32 KB to 64 KB (GitHub Commit). As a workaround where patching is not immediately possible, restrict SFTP access to trusted users and IP ranges, and consider disabling mod_sftp if SFTP functionality is not required.

The Hacker Wire covered the vulnerability shortly after disclosure, noting the heap overflow's potential for RCE via the RENAME request technique (The Hacker Wire). Red Hat acknowledged the vulnerability and opened a tracking bug (Red Hat Bugzilla). VulnCheck, the CVE assigner, published a detailed advisory describing the exploitation chain (VulnCheck Advisory).