Vulnerability record · CVE-2011-0762 · published 2 March 2011
CVE-2011-0762: vsftpd glob filter flaw enables authenticated denial of service
VVsftpd Project · Vsftpd
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 mishandles crafted glob expressions in STAT commands. A remote authenticated user can drive excessive CPU consumption and exhaust process slots, degrading or halting the FTP service. It is a resource-consumption issue distinct from CVE-2010-2632.
Description
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
AV:N/AC:L/Au:S/C:N/I:N/A:P
Automated analysis
high priorityPublic exploit code and a very high EPSS score make this remotely triggerable denial of service a realistic risk despite the medium CVSS 2.0 base score.
What it is
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 mishandles crafted glob expressions in STAT commands. A remote authenticated user can drive excessive CPU consumption and exhaust process slots, degrading or halting the FTP service. It is a resource-consumption issue distinct from CVE-2010-2632.
Impact
An attacker with valid FTP credentials can consume CPU and exhaust process slots, denying service to legitimate users. There is no confidentiality or integrity impact per the CVSS vector.
Attack surface
Reachable over the network via FTP STAT commands containing crafted glob expressions, across multiple sessions. Authentication is required (Au:S) and no user interaction is needed.
Exploitation
Not listed in CISA KEV, but public exploit references exist (Exploit-DB 16270, SecurityFocus BID 46617, SecurityReason) and EPSS is high at 0.73946 (99.456th percentile), indicating elevated likelihood of exploitation.
What to do
- Upgrade vsftpd to 2.3.3 or later, or apply the vendor patch for your distribution.
- Apply distribution security updates (Debian DSA-2305, Ubuntu USN-1098-1, Red Hat RHSA-2011-0337, openSUSE, Fedora, Mandriva advisories).
- Restrict FTP access to trusted accounts and networks, and disable anonymous access where not required.
- Rate-limit or cap concurrent FTP sessions per account to blunt process slot exhaustion.
- Monitor and throttle repeated STAT commands from single accounts.
Detection
- Alert on high volumes of STAT commands, especially with glob metacharacters, from a single account or source.
- Monitor vsftpd CPU usage and process counts for abnormal spikes or slot exhaustion.
- Correlate multiple concurrent FTP sessions from the same authenticated user with repeated STAT activity.
- Review FTP logs for repeated failed or resource-heavy STAT requests preceding service degradation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2011-0762 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2011-0762), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
