CVE-2026-53994: ProFTPD mod_sftp Buffer Overflow Flaw

CVE-2026-53994 Overview

CVE-2026-53994 is a heap-based buffer overflow [CWE-122] in the ProFTPD mod_sftp module. The flaw resides in the fxp_packet_read() function, which accepts an attacker-supplied 32-bit big-endian SFTP packet length without any minimum sanity check. An authenticated SFTP user can send a malformed packet with packet_len=0 and a body larger than approximately 544 bytes to trigger the overflow. This produces reliable authenticated remote denial of service by crashing the per-connection ProFTPD child process. Depending on heap layout, heap metadata corruption and further impact beyond denial of service may be reachable.

Critical Impact
Authenticated SFTP users can crash ProFTPD session children on demand and potentially corrupt adjacent heap metadata via a single malformed SFTP packet.

Affected Products

ProFTPD mod_sftp module
ProFTPD releases prior to 1.3.9
Systems exposing SFTP access to authenticated users

Discovery Timeline

2026-07-18 - CVE-2026-53994 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-53994

Vulnerability Analysis

The vulnerability chains an unsigned integer underflow with a size truncation bug in the ProFTPD memory allocator. The fxp_packet_read() function reads a 32-bit big-endian packet length directly from the SFTP stream. Supplying packet_len=0 causes a later unsigned subtraction in the read path to underflow to roughly 4 GB (0xFFFFFFFF range).

The oversized request then reaches the core memory allocator. The rounded allocation size is computed in size_t but passed to new_block() as a 32-bit int. The low 32 bits of 0x100000000 are 0, so new_block() returns a small block of approximately 512 bytes while telling the caller it received 4 GB.

The subsequent fill loop streams attacker-controlled bytes past the end of the 544-byte allocation. This produces an attacker-controlled heap buffer overflow with predictable corruption of adjacent heap chunks.

Root Cause

The root cause is the absence of a minimum sanity check on the SFTP packet length combined with an integer type mismatch between size_t and 32-bit int at the allocator boundary. Both conditions must be met for the overflow to occur.

Attack Vector

Exploitation requires valid SFTP credentials. Once authenticated, the attacker sends a single crafted SFTP packet with the 32-bit length field set to 0, followed by a payload larger than approximately 544 bytes. No user interaction is needed after authentication.

text

// Patch reference from ProFTPD 1.3.9 release notes
1.3.9 - Released 14-Mar-2025
--------------------------------
- Issue 1855 - Use of HideNoAccess for SFTP sessions can lead to segfault
  and/or unexpected behavior.
+ Fixed memory usage issue with SFTP channels.

Source: GitHub Commit 7342836

Detection Methods for CVE-2026-53994

Indicators of Compromise

Unexpected termination or segmentation faults in ProFTPD session child processes shortly after SFTP authentication.
SFTP session logs showing successful authentication followed immediately by abrupt disconnects.
Core dumps from ProFTPD indicating faults inside mod_sftp or the pool allocator (new_block()).

Detection Strategies

Inspect SFTP packet captures for frames where the 32-bit packet length field equals 0 followed by a body exceeding 544 bytes.
Correlate authentication events with process crash telemetry to identify authenticated denial-of-service attempts.
Enable verbose logging in mod_sftp and alert on anomalous packet parsing errors.

Monitoring Recommendations

Monitor ProFTPD child process exit codes and restart counts for spikes tied to specific accounts.
Track per-user SFTP session duration and disconnect patterns to identify accounts triggering repeated crashes.
Forward ProFTPD and system logs to a centralized SIEM for correlation with authentication activity.

How to Mitigate CVE-2026-53994

Immediate Actions Required

Upgrade ProFTPD to version 1.3.9 or later, which contains the memory handling fix for mod_sftp.
Audit SFTP user accounts and disable or rotate credentials that are unused, shared, or over-privileged.
Restrict SFTP exposure to trusted networks where feasible until the upgrade is complete.

Patch Information

The fix is included in ProFTPD 1.3.9, released 14-Mar-2025. See the upstream commit 7342836fa98e36209660a4c5805c801476f63936 and the VulnCheck Security Advisory for full details. Source packages are available in the ProFTPD GitHub repository.

Workarounds

Disable the mod_sftp module in proftpd.conf if SFTP is not required.
Enforce network-level access controls to limit which clients can reach the SFTP service.
Apply per-user connection rate limits to reduce the impact of repeated crash attempts.

bash

# Disable mod_sftp until upgrade is possible
# In proftpd.conf, comment out the SFTP module load line:
# LoadModule mod_sftp.c

# Verify the running ProFTPD version
proftpd -v

# After upgrade, confirm version is 1.3.9 or later
# ProFTPD Version: 1.3.9