CVE-2026-44186

A flaw was found in the mod_proxy_ftp module of the Apache HTTP Server. A remote attacker, by controlling a backend File Transfer Protocol (FTP) server, can trigger an infinite loop. This vulnerability, categorized as a Loop with Unreachable Exit Condition, leads to a Denial of Service (DoS) for the affected server.

A loop with an unreachable exit condition flaw was found in the mod_proxy_ftp module of the Apache HTTP Server. A remote attacker could exploit this vulnerability by tricking the server into connecting to a malicious or compromised backend FTP server, causing the proxy_ftp_handler component to enter an infinite loop. This results in CPU exhaustion and a denial of service (DoS) condition on the affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, you can disable the mod_proxy_ftp module if your environment does not require it.

Step 1: Disable the Module

Open your Apache HTTP Server configuration file (commonly located at /etc/httpd/conf.modules.d/00-proxy.conf or /etc/httpd/conf/httpd.conf) and comment out or remove the following line:

# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so

Step 2: Restart the Service

Restart the httpd service to apply the configuration changes:

systemctl restart httpd

Note: Disabling this module may impact applications or services that rely on Apache's FTP proxy functionality.