CVE-2011-0418: The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand exp...

Security readout for executives and security teams

CVE-2011-0418 is an availability flaw in brace expansion handling. An authenticated FTP user could make vulnerable Pure-FTPd or NetBSD libc glob processing consume excessive memory through a crafted STAT request, potentially disrupting service. The source bundle does not show code execution, data theft, or confirmed active exploitation. Exposure is most likely on legacy FTP servers running Pure-FTPd before 1.0.32 or systems depending on vulnerable NetBSD 5.1 libc glob behavior. Internet-facing FTP with many authenticated users raises operational risk. Modern, patched systems are unlikely to be affected, but old appliances and unmaintained distributions should be checked. Treat this as a targeted legacy availability risk. It is not a current emergency based on the supplied evidence, but exposed FTP services on old platforms should be remediated during normal vulnerability management, especially where downtime would affect customers or operations. Mitigation focus: Upgrade Pure-FTPd to 1.0.32 or later where applicable.; Apply the relevant NetBSD libc glob vendor fix or OS update.; Review Mandriva, Red Hat, and vendor advisories for downstream package status..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.