← Vulnerability feed

Vulnerability record · CVE-2006-6565 · published 15 December 2006

CVE-2006-6565: FileZilla Server LIST/NLST wildcard NULL pointer dereference DoS

Filezilla Project · Filezilla Server

FileZilla Server before 0.9.22 crashes on a wildcard argument passed to the LIST or NLST FTP commands, caused by a NULL pointer dereference. The record notes the root cause may actually be a malformed PORT command, so the exact trigger is uncertain. It matters because a remote user can take the FTP service down with a simple command sequence.

4.0 CVSS 2.0 Medium EPSS 71% · top 0.6% CWE-476 · NULL pointer dereference
4.0CVSS 2.0 base score
71%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

FileZilla Server before 0.9.22 allows remote attackers to cause a denial of service (crash) via a wildcard argument to the (1) LIST or (2) NLST commands, which results in a NULL pointer dereference, a different set of vectors than CVE-2006-6564. NOTE: CVE analysis suggests that the problem might be due to a malformed PORT command.

AV:N/AC:L/Au:S/C:N/I:N/A:P

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

medium priorityRemote authenticated denial of service with public exploit code and high EPSS, but only availability impact and a fix available since 0.9.22.

What it is

FileZilla Server before 0.9.22 crashes on a wildcard argument passed to the LIST or NLST FTP commands, caused by a NULL pointer dereference. The record notes the root cause may actually be a malformed PORT command, so the exact trigger is uncertain. It matters because a remote user can take the FTP service down with a simple command sequence.

Impact

An attacker gains denial of service: the FileZilla Server process crashes, interrupting FTP service for all connected and future users. No confidentiality or integrity impact is indicated by the CVSS vector.

Attack surface

Reached over the network through the FTP control connection by sending LIST or NLST with a wildcard argument, or possibly a malformed PORT command. The CVSS vector requires authentication (Au:S), and no user interaction is needed.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.70588, 99.4th percentile) and a public Exploit-DB entry (2914) exists, indicating exploit code is publicly available.

What to do

  • Upgrade FileZilla Server to 0.9.22 or later, which the advisory states fixes the issue.
  • If upgrade is not possible, restrict FTP access to trusted networks and disable anonymous or unused accounts.
  • Monitor and rate-limit repeated LIST/NLST and PORT commands per session at the network or FTP proxy layer.
  • Run the FTP service under a supervised process that restarts automatically after a crash to limit downtime.

Detection

  • Alert on FileZilla Server process crashes or unexpected restarts correlated with FTP sessions.
  • Log and review FTP commands containing wildcard arguments to LIST or NLST, and malformed PORT commands.
  • Watch for repeated connection attempts followed by service termination from the same source address.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://sourceforge.net/project/shownotes.php?release_id=470364&group_id=21558 ProductThird Party Advisory
http://www.vupen.com/english/advisories/2006/4937 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30853 Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/2914 ExploitThird Party AdvisoryVDB Entry
http://sourceforge.net/project/shownotes.php?release_id=470364&group_id=21558 ProductThird Party Advisory
http://www.vupen.com/english/advisories/2006/4937 Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/30853 Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/2914 ExploitThird Party AdvisoryVDB Entry

Track CVE-2006-6565 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2014-0160OpenSSL TLS/DTLS Heartbeat Extension Out-of-Bounds Read (Heartbleed)OpenSSL 1.0.1 before 1.0.1g mishandles Heartbeat Extension packets in its TLS and DTLS implementations, causing an out-of-bounds read of process memo…KEVEPSS 100%analysed7.4CVE-2014-0224OpenSSL ChangeCipherSpec handling flaw enables MITM session hijackOpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages. A man-in-the…EPSS 95%analysed5.0CVE-2005-0850Filezilla-project filezilla server improper input validation vulnerabilityFileZilla FTP server before 0.9.6 allows remote attackers to cause a denial of service via a request for a filename containing an MS-DOS device name …EPSS 2.2%5.0CVE-2005-0851Filezilla-project filezilla server vulnerabilityFileZilla FTP server before 0.9.6, when using MODE Z (zlib compression), allows remote attackers to cause a denial of service (infinite loop) via cer…EPSS 2.2%4.3CVE-2015-10003Filezilla-project filezilla server vulnerabilityA vulnerability, which was classified as problematic, was found in FileZilla Server up to 0.9.50. This affects an unknown part of the component PORT …EPSS 0.54%4.3CVE-2009-0884Filezilla-project filezilla server classic buffer overflow vulnerabilityBuffer overflow in FileZilla Server before 0.9.31 allows remote attackers to cause a denial of service via unspecified vectors related to SSL/TLS pac…EPSS 3.4%6.2CVE-2026-21525Windows Remote Access Connection Manager null pointer dereference DoSWindows Remote Access Connection Manager contains a null pointer dereference (CWE-476) that lets an unauthorized attacker deny service locally. The f…KEVEPSS 4.8%analysed

Source: NIST National Vulnerability Database (record CVE-2006-6565), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.