CVE-2004-0299: Buffer overflow in smallftpd 0.99 allows local users to cause a denial of service (crash) via an FTP reques...

Security readout for executives and security teams

This is an old denial-of-service issue in smallftpd where an FTP request containing many slash characters can crash the server. The documented impact is service interruption, not data theft or system takeover. The source data is sparse and has no CVSS score, so urgency depends on whether smallftpd is still running anywhere in the environment. Exposure is most likely limited to legacy systems running smallftpd, especially version 0.99 named by the CVE text. The affected-product metadata in the bundle is incomplete, so inventory confirmation is required before assuming exposure. Treat as a legacy exposure cleanup item unless smallftpd is still internet-facing or business-critical. If present, prioritize replacement or isolation because the documented outcome is service outage and the software appears old with sparse current guidance. Mitigation focus: Inventory systems for smallftpd installations and exposed FTP services.; Check vendor or archival project guidance for fixed versions or retirement recommendations.; Remove or replace smallftpd where it is no longer required..

Prepared

Jun 30, 2026, 06:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.