CVE-2026-63091: 
NixOS vulnerability analysis and mitigation

CVE-2026-63091 is a signed integer overflow vulnerability in ProFTPD's mod_sftp module, specifically in the SCP size-record parser. It affects ProFTPD versions before 1.3.9c and 1.3.10rc1 through 1.3.10rc2 (fixed in 1.3.10rc3). The flaw allows authenticated low-privilege attackers to bypass ASLR by sending a crafted file size value of UINT64_MAX, leaking process memory containing library base addresses. It was disclosed on July 20, 2026, with a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (GitHub Advisory, VulnCheck).

The root cause is an integer overflow (CWE-190) combined with a buffer over-read (CWE-126) in the recv_filesz() function within contrib/mod_sftp/scp.c. The original code parsed the client-supplied file size digit-by-digit into an off_t (signed type) without bounds checking; sending UINT64_MAX causes the value to wrap to a negative off_t. When this negative value is subsequently converted to uint32_t, it produces an approximately 4 GB read length, forcing the server to read well beyond the end of the SSH channel data and write the overread process memory — including libc, libcrypto, and PIE pointers — into the uploaded file, effectively bypassing ASLR (GitHub PR #2201, Commit b9b7dde, VulnCheck). The fix, contributed by Fabian Wahle of Hap Security, replaces the manual digit loop with strtoull() and adds an explicit negative-value check before accepting the file size (Commit b9b7dde).

The primary impact is a high-severity information disclosure: any authenticated low-privilege user can retrieve process memory contents from the ProFTPD server process, including randomized base addresses for libc, libcrypto, and PIE segments. This effectively neutralizes ASLR as a defense, enabling an attacker to reliably chain this disclosure with a separate memory corruption vulnerability in the same process to achieve code execution. There is no direct integrity or availability impact from this vulnerability alone, but it significantly lowers the bar for full server compromise (VulnCheck, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.295%, reflecting low near-term exploitation probability. Exploitation requires valid credentials (low-privilege authenticated access) and the mod_sftp module to be enabled with SCP support, limiting the attack surface compared to unauthenticated vulnerabilities (VulnCheck).

1. Reconnaissance: Identify ProFTPD servers with SFTP/SCP enabled running versions prior to 1.3.9c or between 1.3.10rc1 and 1.3.10rc2, using banner grabbing or service scanning tools (e.g., nmap -sV -p 22).
2. Authenticate: Obtain or use any valid low-privilege account credentials on the target ProFTPD server.
3. Initiate SCP upload: Establish an SSH/SFTP session and begin an SCP file upload to the server (e.g., scp localfile user@target:/upload/path).
4. Send crafted file size: Intercept or craft the SCP protocol message to replace the file size field with UINT64_MAX (18446744073709551615). This causes the recv_filesz() function to store a negative off_t value.
5. Trigger memory over-read: The negative off_t is converted to uint32_t, yielding a ~4 GB read length. The server reads beyond the SSH channel data buffer and writes overread process memory into the uploaded file.
6. Retrieve leaked memory: Download or read the resulting uploaded file, which contains raw process memory including libc, libcrypto, and PIE base address pointers.
7. Derive ASLR offsets: Parse the leaked pointers to calculate the randomized base addresses of loaded libraries, enabling reliable exploitation of any co-existing memory corruption vulnerability in the ProFTPD process (VulnCheck, Commit b9b7dde).

• Network: SCP upload sessions from authenticated users that produce unusually large received file artifacts on the server; SSH sessions where the negotiated transfer size is 18446744073709551615 (UINT64_MAX) in protocol logs.
• File System: Uploaded files on the ProFTPD server that are significantly larger than expected and contain binary data inconsistent with the intended upload content; files containing repeated patterns of memory addresses or library-like binary structures.
• Logs: ProFTPD trace logs (if enabled) showing the message "file size out of range" — note this message is only present in patched versions; on vulnerable versions, no error is logged for the malformed size. Unexpected or zero-byte uploads followed by oversized file creation in the upload directory.
• Process: ProFTPD child processes consuming abnormally high memory or exhibiting unexpected I/O patterns during SCP transfers (VulnCheck, Commit b9b7dde).

Upgrade ProFTPD to version 1.3.9c (stable branch) or 1.3.10rc3 or later (release candidate branch), which include the fix for this vulnerability (ProFTPD v1.3.9c, ProFTPD v1.3.10rc3). As a workaround where patching is not immediately possible, restrict SFTP/SCP access to trusted, known users only and implement network-level controls (firewall rules) to limit who can connect to the ProFTPD service. Disabling SCP support within mod_sftp (if not required) also eliminates the attack surface for this specific vulnerability (VulnCheck).

The vulnerability was reported by Fabian Wahle of Hap Security and credited in the official fix commit (GitHub PR #2201). Red Hat has acknowledged the CVE and published a security advisory (Red Hat CVE). Tenable has released a detection plugin (Nessus plugin #328232) for the vulnerability. The NixOS community also tracked the issue, referencing it in a nixpkgs security update (GitHub PR #2201). No significant social media controversy or broad community debate has been observed.