Vsftpd

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:vsftpd_project:vsftpd:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorVsftpd Project (45ce0228-c916-57b5-9e82-d8288c992633)
ProductVsftpd (fe1f85c8-dc1c-506b-9f45-b3e5da041fa0)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:deb/debian/vsftpd purl2cpe 2026-06-01 10:16:21.708093
pkg:deb/ubuntu/vsftpd purl2cpe 2026-06-01 10:16:21.708096
pkg:github/dagwieers/vsftpd purl2cpe 2026-06-01 10:16:21.708099
pkg:gitlab/redhat/vsftpd purl2cpe 2026-06-01 10:16:21.708102
pkg:rpm/centos/vsftpd purl2cpe 2026-06-01 10:16:21.708105
pkg:rpm/fedora/vsftpd purl2cpe 2026-06-01 10:16:21.708108
pkg:rpm/opensuse/vsftpd purl2cpe 2026-06-01 10:16:21.708111

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2026-119568 vulnerable 2026-11-03 10:17:11.975748 vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
HIGH (7.4)
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Published: 2026-10-30T11:31:14.408Z
Updated: 2026-10-30T15:54:01.560Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2026-119567 vulnerable 2026-11-03 10:17:11.853430 vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
LOW (3.1)
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Published: 2026-10-30T11:31:13.756Z
Updated: 2026-11-05T21:23:32.044Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-3618 vulnerable 2026-06-08 05:33:53.189841 Details available
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
Published: 2022-03-23T00:00:00.000Z
Updated: 2024-08-03T17:01:07.459Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2015-1419 vulnerable 2026-06-08 05:06:25.604671 Details available
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Published: 2015-01-28T11:00:00.000Z
Updated: 2024-08-06T04:40:18.595Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0762 vulnerable 2026-06-08 04:56:39.620926 Details available
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.
Published: 2011-03-02T19:00:00.000Z
Updated: 2024-08-06T22:05:53.406Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.