Vsftpdproject Vsftpd
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Vsftpdproject Vsftpd.
By the Year
In 2026 there have been 2 vulnerabilities in Vsftpdproject Vsftpd with an average score of 5.7 out of ten. Vsftpd did not have any published security vulnerabilities last year. That is, 2 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2 | 5.70 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 1 | 7.50 |
| 2022 | 1 | 7.40 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 1 | 0.00 |
It may take a day or so for new Vsftpd vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Vsftpdproject Vsftpd Security Vulnerabilities
vsftpd 3.0.5 Access Control Bypass via Xprefixed FTP commands
CVE-2026-119567
2.3 - Low
- October 30, 2026
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories.
Denylist / Deny List
vsftpd <=3.0.5 TLS Session Ticket Auth Bypass in ssl_data_accept()
CVE-2026-119568
9.1 - Critical
- October 30, 2026
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data.
Improper Verification of Source of a Communication Channel
VSFTPD 3.0.3 Denial of Service via Limited Connections
CVE-2021-30047
7.5 - High
- August 22, 2023
VSFTPD 3.0.3 allows attackers to cause a denial of service due to limited number of connections allowed.
ALPACA is an application layer protocol content confusion attack
CVE-2021-3618
7.4 - High
- March 23, 2022
ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.
Improper Certificate Validation
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor
CVE-2011-2523
- November 27, 2019
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.
Unspecified vulnerability in vsftpd 3.0.2 and earlier
CVE-2015-1419
- January 28, 2015
Unspecified vulnerability in vsftpd 3.0.2 and earlier allows remote attackers to bypass access restrictions via unknown vectors, related to deny_file parsing.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Vsftpdproject Vsftpd or by Vsftpdproject? Click the Watch button to subscribe.
