CVE-2026-67191

Name of the Vulnerable Software and Affected Versions Xlight FTP Server versions prior to 3.9.5

Description A pre-authentication heap buffer overflow exists when the software processes SSH client identification strings. A logic error in the termination condition of the recv loop uses an incorrect OR operator instead of an AND operator, allowing remote unauthenticated attackers to write data past the end of a heap buffer. This issue affects any SSH or SFTP connection established before authentication.

Recommendations Update Xlight FTP Server to version 3.9.5 or later.