CVE-2001-0136: ProFTPD memory leak in USER command handling enables remote DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

medium priorityRemote unauthenticated denial of service with public exploit references and high EPSS, but limited to availability impact on an old ProFTPD release.

What it is

ProFTPD 1.2.0rc2 leaks memory when processing a series of USER commands, and possibly SIZE commands on improperly installed servers. Repeated requests exhaust server memory and can take the FTP service down. The flaw is remotely reachable and requires no authentication.

Impact

An unauthenticated remote attacker can degrade or crash the ProFTPD service by exhausting memory, denying FTP access to legitimate users. No code execution or data disclosure is described.

Attack surface

Reached over the network via the FTP service by sending repeated USER commands (and possibly SIZE commands if the server is improperly installed). No authentication or user interaction is required, per the AV:N/AC:L/Au:N vector.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.44936, 98.7th percentile) and references carry Exploit tags, indicating public exploit material exists.

What to do

• Upgrade ProFTPD to a version later than 1.2.0rc2 that fixes the memory leak.
• Apply vendor security updates from Debian (DSA-029), Conectiva, or Mandrake advisories for affected distributions.
• Restrict FTP exposure to trusted networks and rate-limit or throttle repeated USER/SIZE commands at the firewall or proxy.
• Monitor ProFTPD process memory and restart or cap resources if growth is observed.

Detection

• Alert on high volumes of USER commands from a single source IP in ProFTPD logs.
• Track ProFTPD process RSS growth over time and flag sustained upward trends.
• Watch for repeated SIZE commands from unauthenticated sessions on servers where that path is reachable.
• Correlate FTP connection bursts with service restarts or out-of-memory events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.