CVE-2008-2375: Memory leak in a certain Red Hat deployment of vsftpd before 2.0.5 on Red Hat Enterprise Linux (RHEL) 3 and...

Security readout for executives and security teams

This CVE is a denial-of-service flaw in a Red Hat-specific vsftpd deployment. An unauthenticated remote user could consume server memory by making many failed login attempts in one FTP session, potentially disrupting FTP service on affected legacy systems. Exposure appears limited to legacy RHEL 3 or 4 systems running the affected Red Hat vsftpd package with PAM enabled. Modern systems are unlikely to be affected unless they retain old packages or downstream appliances based on those releases. Treat this as a legacy service availability risk. It is unlikely to affect current infrastructure, but any exposed RHEL 3 or 4 FTP service should be prioritized for remediation or retirement. Mitigation focus: Apply the relevant Red Hat vsftpd errata for affected RHEL 3 or 4 systems.; Check downstream vendor advisories for appliances based on affected Red Hat packages.; Upgrade or replace unsupported legacy FTP infrastructure where vendor updates are unavailable..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.