CVE-2019-19269: An issue was discovered in tls_verify_crl in ProFTPD through 1.3.6b.

Security readout for executives and security teams

CVE-2019-19269 is a ProFTPD denial-of-service issue. In a specific TLS mutual-authentication setup, an empty certificate revocation list installed by an administrator can cause ProFTPD to dereference a NULL pointer while validating a client certificate. This can crash affected service handling rather than expose data. Exposure is mainly ProFTPD servers through 1.3.6b that use TLS client/server mutual authentication and CRL checking. Systems without client-certificate validation or without an empty CRL condition appear less exposed based on the provided sources. Prioritize remediation for internet-facing or business-critical file-transfer services using TLS client certificates. The issue is configuration-dependent and availability-focused, so urgency is below code-execution flaws but still relevant for services with operational uptime requirements. Mitigation focus: Apply ProFTPD security updates from your operating system or vendor advisory.; Upgrade affected ProFTPD deployments beyond the vulnerable release where vendor packages allow.; Review TLS mutual-authentication and CRL configuration for empty CRL files..

Prepared

Jun 6, 2026, 12:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.