CVE-1999-0904: Buffer overflow in BFTelnet allows remote attackers to cause a denial of service via a long username.

Security readout for executives and security teams

CVE-1999-0904 is a very old flaw in BFTelnet, a Telnet server program. A remote user could crash the service by supplying an overly long username. The impact is a denial of service, meaning the server stops responding. There is no evidence of ongoing exploitation, and modern environments are unlikely to run this software. Exposure is minimal today. BFTelnet is a legacy Windows Telnet server rarely deployed in modern environments, and Telnet itself has been widely displaced by SSH. Any residual exposure would be limited to unmanaged legacy systems still running BFTelnet on reachable networks. Low priority. This is a 1999-era denial-of-service issue in obsolete software with no evidence of modern exploitation. Treat any discovery of BFTelnet as a legacy-hygiene finding: retire the software and move remote access to SSH rather than allocating incident-response resources. Mitigation focus: Inventory hosts for any running BFTelnet or legacy Telnet server processes.; Decommission BFTelnet and migrate remote administration to SSH.; Block inbound TCP/23 at perimeter and internal segmentation boundaries..

Prepared

Jul 12, 2026, 01:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.