CVE-2026-44186 PUBLISHED

Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

Assigner: apache
Reserved: 05.05.2026 Published: 08.06.2026 Updated: 08.06.2026

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in the mod_proxy_ftp module in Apache HTTP Server with an attacker controlled backend FTP server.

This issue affects undefined: from 2.4.0 through 2.4.67.

Users are recommended to upgrade to version 2.4.68, which fixes the issue.

Product Status

Vendor Apache Software Foundation
Product Apache HTTP Server
Versions Default: unaffected
  • affected from 2.4.0 to 2.4.67 (incl.)

Credits

  • Zhenpeng (Leo) Lin at depthfirst finder

References

Problem Types

  • CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') CWE