CVE-2026-44186

What it actually does

CVE-2026-44186 is an infinite-loop flaw in Apache HTTP Server's mod_proxy_ftp module affecting versions 2.4.0 through 2.4.67. When Apache is configured to proxy FTP traffic and is made to communicate with an attacker-controlled FTP backend, crafted FTP server behavior can cause the proxy module to enter a loop with no reachable exit condition. The primary result is denial of service: Apache worker threads or processes can become stuck, CPU and connection capacity can be exhausted, and legitimate HTTP service can degrade or fail.

Why it matters to the business

Organizations using Apache HTTP Server with FTP proxying enabled may experience website or application outages if an attacker can drive traffic through the vulnerable proxy path to a malicious FTP server. Although this is not currently listed in CISA KEV and has low EPSS at the time of assessment, the vulnerability is remotely reachable, requires no authentication, and can affect internet-facing services, making it important to remediate during normal high-priority patch cycles, especially for systems that rely on Apache for customer-facing availability.

How an attack unfolds

An attacker first identifies an Apache HTTP Server instance that has mod_proxy_ftp enabled and exposes a route capable of proxying requests to FTP backends. This may be a reverse-proxy configuration pointing to an FTP service the attacker controls, or an overly permissive forward-proxy configuration that allows the attacker to choose an FTP destination. The attacker then sends a request that causes Apache to initiate an FTP proxy connection to the malicious backend. The attacker's FTP server responds with crafted protocol behavior that triggers the unreachable-exit loop in mod_proxy_ftp. Each successful attempt can tie up an Apache worker or consume CPU, and repeated requests can reduce available worker capacity until the service becomes slow, intermittently unavailable, or fully unavailable.

How to fix it

Upgrade Apache HTTP Server to version 2.4.68 or later, which fixes the issue. If immediate upgrade is not possible, disable mod_proxy_ftp wherever it is not strictly required, remove or restrict ProxyPass and proxy rules that target ftp:// backends, and ensure Apache is not configured as an unrestricted forward proxy. Limit access to any required FTP proxy routes with authentication, allowlists, network controls, and rate limiting. Restart or gracefully reload Apache after patching or configuration changes so the fixed module and updated configuration are active.

How to confirm the fix worked

Confirm the running Apache version is 2.4.68 or later using the platform package manager and Apache version commands such as httpd -v or apache2 -v. Confirm whether mod_proxy_ftp is loaded with commands such as httpd -M, apachectl -M, or apache2ctl -M and verify it is absent if not required. Review Apache configuration for ftp:// ProxyPass, ProxyRemote, ProxyRequests, and related proxy directives. Validate that forward proxying is disabled unless explicitly required, and that FTP proxy routes cannot reach untrusted attacker-controlled destinations. After remediation, restart or reload Apache and confirm the live process is running the updated binary/module, not only that the package is installed.

Typical attack path

1. Scan for Apache HTTP Server instances exposing proxy behavior or FTP proxy routes.
2. Determine whether FTP proxying is enabled through observable behavior, open proxy testing, or known application routes that map to ftp:// backends.
3. Operate or control an FTP backend that Apache can be induced to contact.
4. Send unauthenticated requests to Apache that trigger mod_proxy_ftp handling for the attacker-controlled FTP destination.
5. Return crafted FTP responses that cause mod_proxy_ftp to enter an infinite loop.
6. Repeat requests to consume Apache workers, CPU, or connection capacity until legitimate service is degraded or denied.

How to detect it

Look for evidence of both exposure and attempted exploitation. Review Apache access logs for requests that involve ftp:// destinations, FTP proxy routes, unusual repeated requests to the same proxy endpoint, long response times, client-aborted requests, or spikes in 5xx/timeout responses. Review Apache error logs at normal and debug verbosity for proxy_ftp or mod_proxy_ftp messages around service degradation windows. Correlate with host telemetry showing sustained CPU consumption by httpd/apache2 worker processes, a growing number of busy workers, MaxRequestWorkers exhaustion, connection queue growth, or frequent Apache restarts. Review network flow logs for Apache servers initiating outbound FTP connections to unusual or untrusted hosts, especially TCP/21 and passive FTP data channels, immediately before CPU spikes or availability incidents. Because exploitation may not leave a unique payload string, detection should rely on correlation among FTP proxy requests, outbound FTP connections, Apache worker exhaustion, and abnormal backend FTP server behavior.

• LoadModule proxy_ftp_module
• mod_proxy_ftp.so
• proxy_ftp_module
• ProxyPass ftp://
• ProxyPassReverse ftp://
• ProxyRemote ftp://
• ProxyRequests On
• ftp://
• httpd -M
• apachectl -M
• apache2ctl -M
• /server-status
• BusyWorkers
• MaxRequestWorkers
• server reached MaxRequestWorkers
• AH00161: server reached MaxRequestWorkers setting
• AH00484: server reached MaxRequestWorkers setting

What your security team should do

• Inventory Apache HTTP Server deployments and prioritize any internet-facing systems running versions 2.4.0 through 2.4.67.
• Patch affected Apache installations to 2.4.68 or later, prioritizing servers with mod_proxy_ftp enabled or any ftp:// proxy configuration.
• Disable mod_proxy_ftp if FTP proxying is not a documented business requirement.
• Audit Apache proxy configuration to ensure ProxyRequests is not unintentionally enabled and that FTP proxy destinations are restricted to trusted backends.
• Add monitoring for Apache worker exhaustion, sustained httpd/apache2 CPU spikes, proxy FTP errors, request timeouts, and unusual volumes of ftp:// proxy requests.
• If exploitation is suspected, preserve Apache access logs, error logs, proxy logs, process telemetry, and network flow data before restarting services.
• Apply network egress controls so web proxy tiers cannot connect to arbitrary FTP servers on TCP ports 21 or passive FTP ranges unless explicitly required.