CVE-2026-119568 vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
CriticalCVSS 9.1
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vsftpd | <= 3.0.5 | No fix listed |
| azure linux vsftpd(Azure Linux:3.0) | All versions | No fix listed |
| debian/vsftpd(Debian:12) | All versions | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.3-13 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.3-13.1 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.1 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.2 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.3 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.4 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.5 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.6 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-0.7 | No fix listed |
| debian/vsftpd(Debian:12) | = 3.0.5-1 | No fix listed |
| debian/vsftpd(Debian:13) | All versions | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.2 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.3 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.4 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.5 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.6 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-0.7 | No fix listed |
| debian/vsftpd(Debian:13) | = 3.0.5-1 | No fix listed |
| debian/vsftpd(Debian:14) | All versions | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-0.2 | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-0.3 | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-0.4 | No fix listed |
Show 8 more
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/vsftpd(Debian:14) | = 3.0.5-0.5 | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-0.6 | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-0.7 | No fix listed |
| debian/vsftpd(Debian:14) | = 3.0.5-1 | No fix listed |
| ubuntu/vsftpd(Ubuntu:22.04) | All versions | No fix listed |
| ubuntu/vsftpd(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/vsftpd(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/vsftpd(Ubuntu:26.10) | All versions | No fix listed |
References
- abraxaslabs.tech third-party-advisory
- security.appspot.com product
- VulnCheck Advisory: vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking third-party-advisory
- MSRC Security Update Guide vendor-advisory
- Release Notes vendor-advisory
- Debian Security Tracker CVE-2026-119568 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- www.cve.org