CVE-2005-0256

The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to...

5.0 MediumPublic exploitFix available

The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to cause a denial of service (CPU exhaustion by recursion) via a glob pattern with a large number of * (wildcard) characters, as demonstrated using the dir command.

Exploit likelihood

5.21%Down 7.4 points since Feb 4, 2022

What each source reports

NVD Score used 5.0

Record: CVE-2005-0256
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-0256
Updated: 2026-11-02

EUVDEUVD-2005-0257 No score

Record: EUVD-2005-0257
Updated: 2026-11-03

GitHub AdvisoriesGHSA-52rf-pfj9-676q No score

The wu_fnmatch function in wu_fnmatch.c in wu-ftpd 2.6.1 and 2.6.2 allows remote attackers to...

Record: GHSA-52rf-pfj9-676q
Weakness: CWE-119
Updated: 2026-11-02

Affected products

washington university wu-ftpd

Affected packages

Affected packages
Package	Affected	Fixed
`wu-ftpd` Debian:3.0	before 2.6.2-3woody5, plus listed versions 2.6.2-3woody4	2.6.2-3woody5

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	WU-FTPD 2.6.2 - File Globbing Denial of Service	2005-02-25

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-0256 is a medium vulnerability (CVSS 5.0) in Washington University Wu-ftpd, published February 25, 2005. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 5.21%, the 92nd percentile. Fixed in wu-ftpd 2.6.2-3woody5.

References

Show 10 moreShow less