CVE-2025-14242
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
A flaw in vsftpd allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing. A remote, authenticated attacker can crash the server by sending a crafted STAT command with a specific byte sequence.
Risk Assessment
The risk is that an authenticated user can disrupt the FTP server's operation, potentially causing service unavailability for other clients.
Recommendation
Immediately update vsftpd to a version that includes a fix for the integer overflow vulnerability.
Other vulnerabilities in vsftpd
See all- CVE-2026-119568High
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
- CVE-2026-119567Low
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Original NVD description (English source)
A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS