{
  "from_raw": "Eric Covener <covener@apache.org>",
  "from": "Eric Covener <co...@apache.org>",
  "gravatar": "ee9bd44fca004cd144fce0d972679406",
  "to": "an...@apache.org,\n de...@httpd.apache.org",
  "subject": "CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling",
  "message-id": "<810efa60-2a49-8d56-26b5-7fb652101f47@apache.org>",
  "mid": "61obl7l634zm9p0dklxzc9c859pkbygd",
  "permalinks": [
    "61obl7l634zm9p0dklxzc9c859pkbygd",
    "r7ff9954674c990c07750627e47a20300eb1c6abf258db9fb66ff2628@<announce.apache.org>"
  ],
  "dbid": "f1cf966a82879b40978b5cec404daf7e9e3a9aa33837300de4d4f2b1e51ae37c",
  "cc": "de...@httpd.apache.org",
  "epoch": 1790878066,
  "list": "<announce.apache.org>",
  "list_raw": "<announce.apache.org>",
  "date": "2026/10/01 18:07:46",
  "private": false,
  "references": "",
  "in-reply-to": "",
  "body": "Severity: low \n\nAffected versions:\n\n- Apache HTTP Server 2.4.0 through 2.4.68\n\nDescription:\n\nImproper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue.\n\nCredit:\n\nZhen Kong (finder)\n4ra1n, pyn3rd and unam4 (finder)\nCharles Vosburgh (finder)\nsungbyeongchan (finder)\nDaradigu / RELAUNCH DEPT. (finder)\n\nReferences:\n\nhttps://httpd.apache.org/security/vulnerabilities_24.html\nhttps://httpd.apache.org/\nhttps://www.cve.org/CVERecord?id=CVE-2026-63045\n\nTimeline:\n\n2026-07-07: Report received\n2026-10-01: fixed in 2.4.x by r1938674\n2026-10-01: 2.4.69 released\n\n",
  "body_short": "Severity: low \n\nAffected versions:\n\n- Apache HTTP Server 2.4.0 through 2.4.68\n\nDescription:\n\nImproper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Ser",
  "html_source_only": false,
  "attachments": [],
  "forum": "announce@apache.org",
  "size": 3496,
  "id": "61obl7l634zm9p0dklxzc9c859pkbygd"
}