Alerts This Week
Warning Icon 1 1,154
Alerts This Week
Warning Icon 1 1,154

Fedora 43 proftpd Significant SQL Injection Issue 2026-4ddb108952

fedora
Calendar Grey May 21, 2026
Dist Fedora Esm H88
Fedora 43 proftpd update addresses SQL injection through reverse DNS records vulnerability with advisory 2026-4ddb108952.
This update contains an updated mod_wrap2_sql that addresses a potential SQL injection issue when connected to from a client with a maliciously-constructed reverse DNS record (CVE-...

Summary

ProFTPD is an enhanced FTP server with a focus toward simplicity, security,

and ease of configuration. It features a very Apache-like configuration

syntax, and a highly customizable server infrastructure, including support for

multiple 'virtual' FTP servers, anonymous FTP, and permission-based directory

visibility.

This package defaults to the standalone behavior of ProFTPD, but all the

needed scripts to have it run by systemd instead are included.

Update Information:

This update contains an updated mod_wrap2_sql that addresses a potential SQL injection issue when connected to from a client with a maliciously-constructed reverse DNS record (CVE-2026-44331). Note that mod_wrap2_sql is not enabled by default and the issue can only happen if UseReverseDNS is enabled, which is also off by default.

Topics%20covered

Topics Covered

security advisory SQL Injection fedora remote code execution important proftpd

Change Log

* Mon May 11 2026 Paul Howarth - 1.3.9a-2 - Additional escaping for avoidance of SQL injection issues with %{note:...} and %{env:...}; these are on top of the existing fix for CVE-2026-42167 in 1.3.9a - Fix for SQL Injection in mod_wrap2_sql via reverse DNS hostname (CVE-2026-44331, rhbz#2466899, https://github.com/proftpd/proftpd/issues/2057)

References


[ 1 ] Bug #2466899 - CVE-2026-44331 proftpd: SQL injection via reverse DNS hostname [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2466899

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-4ddb108952' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
important
Lowest
Low
Medium
High
Critical

Name: proftpd
Product: Fedora 43
Version: 1.3.9a
Release: 2.fc43
URL: http://www.proftpd.org/
Summary: Flexible, stable and highly-configurable FTP server

Topics%20covered

Topics Covered

security advisory SQL Injection fedora remote code execution important proftpd

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here