CVE-2011-0762: The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to...

Security readout for executives and security teams

CVE-2011-0762 is a denial-of-service flaw in vsftpd before 2.3.3. An authenticated FTP user could send crafted filename pattern requests through STAT across multiple sessions, consuming CPU and process slots. The likely business impact is FTP service disruption, not data theft or code execution based on the provided sources. Exposure is most likely on systems running vsftpd versions before 2.3.3, especially internet-facing FTP servers allowing user authentication. The provided affected-product metadata is incomplete, so confirm through package inventory rather than assuming distribution coverage. Treat this as a service-availability risk for legacy FTP infrastructure. Prioritize remediation if FTP is internet-facing, business-critical, or used by external accounts. It is less urgent than unauthenticated remote code execution, but old exposed FTP services should be cleaned up quickly. Mitigation focus: Upgrade vsftpd to 2.3.3 or later using vendor-supported packages.; Apply relevant distribution security updates from Debian, Fedora, SUSE, Ubuntu, or vendor channels.; Restrict FTP authentication to trusted users and networks where possible..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.