CVE-2020-1934: Apache HTTP Server mod_proxy_ftp uninitialized memory use

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

medium priorityThe flaw requires a non-default proxy configuration and a malicious FTP server, and impact is limited to low confidentiality loss, though the high EPSS percentile warrants timely patching.

What it is

Apache HTTP Server 2.4.0 through 2.4.41 has a flaw in mod_proxy_ftp where uninitialized memory may be used when proxying to a malicious FTP server. The issue is a CWE-908 use of uninitialized resource, and it matters because it can leak memory contents or cause undefined behavior in the proxy process.

Impact

An attacker controlling the FTP server that httpd proxies to can potentially read uninitialized memory contents or trigger unpredictable behavior in the affected process. The CVSS vector limits impact to low confidentiality loss with no integrity or availability effect.

Attack surface

Reachable over the network (AV:N) with no privileges or user interaction required (PR:N, UI:N), but only when the server is configured to use mod_proxy_ftp to proxy requests to an attacker-controlled or malicious FTP server.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS shows a 30-day probability of 0.51951 (98.9th percentile), indicating elevated predicted exploitation activity, though references are advisories and patches rather than exploit code.

What to do

• Upgrade Apache HTTP Server to a version after 2.4.41 that contains the fix.
• Apply vendor patches from Apache, Debian, Ubuntu, Fedora, openSUSE, Oracle or NetApp advisories as applicable.
• Disable or avoid mod_proxy_ftp unless FTP proxying is strictly required.
• Restrict outbound proxy connections so httpd cannot reach untrusted or attacker-controlled FTP servers.

Detection

• Review httpd configuration for enabled mod_proxy_ftp directives and ProxyPass rules pointing at FTP backends.
• Monitor httpd error and access logs for proxy requests to unexpected or external FTP hosts.
• Watch for crashes or abnormal restarts of httpd processes handling FTP proxy traffic.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.