CVE-2026-63045: Apache HTTP Server: mod_proxy_ftp PASV address handling

Apache HTTP Server’s mod_proxy_ftp does not properly validate the address in an FTP server’s PASV reply. In a forward-proxy configuration, an untrusted FTP server can return a crafted PASV response that makes the proxy open its data connection to an arbitrary third-party host rather than back to that FTP server. An attacker who can have the proxy retrieve from a malicious FTP server can abuse it to reach internal or external hosts chosen by the attacker (an FTP bounce / proxy-connection abuse issue), not to run code on the proxy itself. All platforms running Apache HTTP Server through 2.4.68 with mod_proxy_ftp as a forward proxy are affected; 2.4.69 fixes the check. It is not on the CISA KEV list, has no CVSS score yet, and no public proof-of-concept is known.