In Apache HTTP Server versions 2.4.0 to 2.4.41, the mod_proxy_ftp module may use uninitialized memory when acting as a proxy to a malicious FTP server. This behavior can result in the exposure of potentially sensitive memory contents. The issue is specific to the mod_proxy_ftp component and occurs during proxy operations. The vulnerability has been identified in numerous Ubuntu package versions of Apache 2.4. No evidence of active exploitation is currently known.

The vulnerability may allow an attacker controlling a malicious FTP server to cause the Apache HTTP Server's mod_proxy_ftp module to use uninitialized memory, potentially leading to limited information disclosure. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Ubuntu and Apache advisories for updates and apply patches when available. Until patched, avoid proxying to untrusted or malicious FTP servers with mod_proxy_ftp enabled.