UpHeron
All vulnerabilities

Servers and applications

CVE-2011-0418

The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.

Severity
Medium 4.0
Published
24 May 2011
Last changed
16 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
7.3% in the next 30 daysHigher than 94% of CVEs. EPSS by FIRST, 12 Nov 2026
Weakness
Improper input validation (CWE-20)
Attack
Over the network · Needs a login
Attacker can
Slow it down
CVSS vector
AV:N/AC:L/Au:S/C:N/I:N/A:P
Sources
NVD

Affected software

SoftwareAffected versions
Pure-FTPdServers and applications · cpe:a:pureftpd:pure-ftpd
  • Version 1.0.30
  • Version 1.0.29
  • Version 1.0.28
  • Version 1.0.27
All 89 release lines
  • Every version up to 1.0.31
  • Version 0.90
  • Version 0.91
  • Version 0.92
  • Version 0.93
  • Version 0.94
  • Version 0.95-pre1
  • Version 0.95-pre2
  • Version 0.95-pre3
  • Version 0.95-pre4
  • Version 0.95
  • Version 0.95.1
  • Version 0.95.2
  • Version 0.96pre1
  • Version 0.96
  • Version 0.96.1
  • Version 0.97pre1
  • Version 0.97pre2
  • Version 0.97pre3
  • Version 0.97pre4
  • Version 0.97pre5
  • Version 0.97-final
  • Version 0.97.1
  • Version 0.97.2
  • Version 0.97.3
  • Version 0.97.4
  • Version 0.97.5
  • Version 0.97.6
  • Version 0.97.7pre1
  • Version 0.97.7pre2
  • Version 0.97.7pre3
  • Version 0.97.7
  • Version 0.98pre1
  • Version 0.98pre2
  • Version 0.98-final
  • Version 0.98.1
  • Version 0.98.2
  • Version 0.98.2a
  • Version 0.98.3
  • Version 0.98.4
  • Version 0.98.5
  • Version 0.98.6
  • Version 0.98.7
  • Version 0.99pre1
  • Version 0.99pre2
  • Version 0.99
  • Version 0.99a
  • Version 0.99b
  • Version 0.99.1
  • Version 0.99.1a
  • Version 0.99.1b
  • Version 0.99.2
  • Version 0.99.2a
  • Version 0.99.3
  • Version 0.99.4
  • Version 0.99.9
  • Version 1.0.0
  • Version 1.0.1
  • Version 1.0.2
  • Version 1.0.3
  • Version 1.0.4
  • Version 1.0.5
  • Version 1.0.6
  • Version 1.0.7
  • Version 1.0.8
  • Version 1.0.9
  • Version 1.0.10
  • Version 1.0.11
  • Version 1.0.12
  • Version 1.0.13a
  • Version 1.0.14
  • Version 1.0.15
  • Version 1.0.16a
  • Version 1.0.16b
  • Version 1.0.16c
  • Version 1.0.17
  • Version 1.0.17a
  • Version 1.0.18
  • Version 1.0.19
  • Version 1.0.20
  • Version 1.0.21
  • Version 1.0.22
  • Version 1.0.24
  • Version 1.0.25
  • Version 1.0.26
  • Version 1.0.27
  • Version 1.0.28
  • Version 1.0.29
  • Version 1.0.30

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2011-0418
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2011-0418