CVE-2026-44186: Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftp

Synopsis

An infinite loop vulnerability exists in the mod_proxy_ftp module of Apache HTTP Server versions 2.4.0 through 2.4.67. An attacker who controls a backend FTP server can trigger the loop remotely, with no authentication required, by sending crafted FTP responses through the proxy. Successful exploitation causes the affected Apache worker process to hang indefinitely, disrupting service availability and also allowing limited reads and writes against the proxied connection. Although Apache recommends upgrading to 2.4.68, no fix version has been formally published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available the moment the upstream fix is confirmed.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Apache HTTP Server's FTP proxy interface over the network, or control a backend FTP server that the proxy connects to.

• AuthenticationNot required

  No credentials are needed to trigger the vulnerable code path; the attack can be launched without any account on the target system.

• Victim interactionNot required

  No user action is required; the attacker initiates the exploit entirely by controlling the backend FTP server responses.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or specific environmental configuration.

Blast Radius

• An attacker causes an Apache worker process to enter an infinite loop, hanging that worker and degrading or fully blocking request handling for the proxied service.
• With a CVSS confidentiality impact of Low, the attacker reads a limited subset of proxied FTP data or HTTP response content passing through the affected module.
• With a CVSS integrity impact of Low, the attacker is able to make limited modifications to proxied FTP transactions in transit.
• Repeated triggering of the loop exhausts the available Apache worker pool, taking the proxy endpoint offline for legitimate users.