CVE-2026-63045

A flaw was found in httpd. When configured as a forward proxy using the mod_proxy_ftp module, the server improperly validates the network address returned in a File Transfer Protocol (FTP) passive mode (PASV) response. A malicious FTP server can exploit this flaw by returning a crafted reply, forcing the proxy to establish a data connection to an arbitrary third-party host. This issue may allow an attacker to initiate unauthorized network connections or probe internal systems that are otherwise inaccessible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Disable the mod_proxy_ftp module or ensure forward proxying is disabled in the Apache HTTP Server configuration.

1. Comment out the mod_proxy_ftp module load line in /etc/httpd/conf.modules.d/00-proxy.conf:

# LoadModule proxy_ftp_module modules/mod_proxy_ftp.so

2. Ensure forward proxying is turned off in /etc/httpd/conf/httpd.conf:

ProxyRequests Off

3. Reload the httpd service to apply changes:

systemctl reload httpd

Caveat: Disabling mod_proxy_ftp terminates the ability of httpd to proxy FTP requests. Warning: Reloading or restarting the httpd service will briefly affect active connections while configuration changes are reloaded.