CVE-2026-63045

Summary

The flaw allows an untrusted FTP server to trick the Apache HTTP Server proxy into connecting to any third-party host, potentially enabling man-in-the-middle attacks or data exfiltration. This affects forward proxy configurations where the server acts as a gateway for FTP traffic.

Exploitability

Exploitation requires a malicious FTP server to craft a specific PASV response that tricks the proxy into opening a data connection to an arbitrary host, with no additional preconditions needed beyond the proxy being configured in forward mode.

Blast radius

In a typical deployment, this could allow attackers to redirect FTP data connections to external hosts, potentially enabling them to intercept or manipulate FTP traffic between internal clients and external FTP servers.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Apache HTTP Server version 2.4.69 which fixes this issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.