Every CVE Search/ Get API key

CVE-2025-14242

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

6.5 MediumFix available

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.81%Up 0.7 points since Jan 15, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Record
CVE-2025-14242
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-05
EUVDEUVD-2026-2461 6.5

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Record
EUVD-2026-2461
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
GitHub AdvisoriesGHSA-6v4g-392h-r9mh 6.5

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer...

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Record
GHSA-6v4g-392h-r9mh
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-02
NVD 6.5

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Record
CVE-2025-14242
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190
Updated
2026-11-05
OSVDEBIAN-CVE-2025-14242 6.5

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.

Record
DEBIAN-CVE-2025-14242
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-1345 6.5

vsftpd security update

Vsftpd, (or very secure FTP daemon), is an FTP server for Unix-like systems, including Linux. It is licensed under the GNU General Public License. It supports IPv6 and SSL. Vsftpd supports explicit (since 2.0.0) and implicit (since 2.1.0) FTPS.

Security Fix(es):

A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a remote, authenticated attacker sending a crafted STAT command with a specific byte sequence.(CVE-2025-14242)

Record
OESA-2026-1345
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 18 moreShow less
OSVRHSA-2026:0605 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:0605
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:0606 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:0606
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:0608 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:0608
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4470 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4470
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4477 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4477
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4513 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4513
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4522 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4522
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4525 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4525
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4543 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4543
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4550 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4550
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4553 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4553
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:4554 6.5

Red Hat Security Advisory: vsftpd security update

Record
RHSA-2026:4554
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:0605 6.5

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:0605
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:0606 6.5

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:0606
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:0608 6.5

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:0608
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:0605 No score

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:0605
Updated
2026-11-02
OSVALSA-2026:0606 No score

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:0606
Updated
2026-11-02
OSVALSA-2026:0608 No score

Moderate: vsftpd security update

The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

  • vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:0608
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
vsftpd
AlmaLinux:9
 before 3.0.5-6.el9_7.2
3.0.5-6.el9_7.2
vsftpd
AlmaLinux:10
 before 3.0.5-10.el10_1.1
3.0.5-10.el10_1.1
vsftpd
AlmaLinux:8
 before 3.0.3-36.el8_10.3
3.0.3-36.el8_10.3
vsftpd
openEuler:20.03-LTS-SP4
 before 3.0.3-33.oe2003sp4
3.0.3-33.oe2003sp4
vsftpd
openEuler:22.03-LTS-SP4
 before 3.0.3-34.oe2203sp4
3.0.3-34.oe2203sp4
vsftpd
openEuler:24.03-LTS
 before 3.0.5-3.oe2403sp3
3.0.5-3.oe2403sp3
vsftpd
openEuler:24.03-LTS-SP1
 before 3.0.5-3.oe2403sp1
3.0.5-3.oe2403sp1
vsftpd
openEuler:24.03-LTS-SP2
 before 3.0.5-3.oe2403sp2
3.0.5-3.oe2403sp2
vsftpd
openEuler:24.03-LTS-SP3
 before 3.0.5-3.oe2403sp3
3.0.5-3.oe2403sp3
vsftpd
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.5-6.el9_7.2
0:3.0.5-6.el9_7.2
Show 50 moreShow less
Affected packages
PackageAffectedFixed
vsftpd-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.5-6.el9_7.2
0:3.0.5-6.el9_7.2
vsftpd-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:3.0.5-6.el9_7.2
0:3.0.5-6.el9_7.2
vsftpd
Red Hat:enterprise_linux:10.1
 before 0:3.0.5-10.el10_1.1
0:3.0.5-10.el10_1.1
vsftpd-debuginfo
Red Hat:enterprise_linux:10.1
 before 0:3.0.5-10.el10_1.1
0:3.0.5-10.el10_1.1
vsftpd-debugsource
Red Hat:enterprise_linux:10.1
 before 0:3.0.5-10.el10_1.1
0:3.0.5-10.el10_1.1
vsftpd
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.3-36.el8_10.3
0:3.0.3-36.el8_10.3
vsftpd-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.3-36.el8_10.3
0:3.0.3-36.el8_10.3
vsftpd-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.3-36.el8_10.3
0:3.0.3-36.el8_10.3
vsftpd
Red Hat:rhel_aus:8.2::appstream
 before 0:3.0.3-31.el8_2.1
0:3.0.3-31.el8_2.1
vsftpd-debuginfo
Red Hat:rhel_aus:8.2::appstream
 before 0:3.0.3-31.el8_2.1
0:3.0.3-31.el8_2.1
vsftpd-debugsource
Red Hat:rhel_aus:8.2::appstream
 before 0:3.0.3-31.el8_2.1
0:3.0.3-31.el8_2.1
vsftpd
Red Hat:rhel_aus:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd-debuginfo
Red Hat:rhel_aus:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd-debugsource
Red Hat:rhel_aus:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd-debuginfo
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd-debugsource
Red Hat:rhel_eus_long_life:8.4::appstream
 before 0:3.0.3-33.el8_4.1
0:3.0.3-33.el8_4.1
vsftpd
Red Hat:rhel_eus:9.6::appstream
 before 0:3.0.5-6.el9_6.1
0:3.0.5-6.el9_6.1
vsftpd-debuginfo
Red Hat:rhel_eus:9.6::appstream
 before 0:3.0.5-6.el9_6.1
0:3.0.5-6.el9_6.1
vsftpd-debugsource
Red Hat:rhel_eus:9.6::appstream
 before 0:3.0.5-6.el9_6.1
0:3.0.5-6.el9_6.1
vsftpd
Red Hat:rhel_e4s:9.2::appstream
 before 0:3.0.5-4.el9_2.1
0:3.0.5-4.el9_2.1
vsftpd-debuginfo
Red Hat:rhel_e4s:9.2::appstream
 before 0:3.0.5-4.el9_2.1
0:3.0.5-4.el9_2.1
vsftpd-debugsource
Red Hat:rhel_e4s:9.2::appstream
 before 0:3.0.5-4.el9_2.1
0:3.0.5-4.el9_2.1
vsftpd
Red Hat:rhel_eus:9.4::appstream
 before 0:3.0.5-5.el9_4.1
0:3.0.5-5.el9_4.1
vsftpd-debuginfo
Red Hat:rhel_eus:9.4::appstream
 before 0:3.0.5-5.el9_4.1
0:3.0.5-5.el9_4.1
vsftpd-debugsource
Red Hat:rhel_eus:9.4::appstream
 before 0:3.0.5-5.el9_4.1
0:3.0.5-5.el9_4.1
vsftpd
Red Hat:rhel_e4s:9.0::appstream
 before 0:3.0.3-49.el9_0.1
0:3.0.3-49.el9_0.1
vsftpd-debuginfo
Red Hat:rhel_e4s:9.0::appstream
 before 0:3.0.3-49.el9_0.1
0:3.0.3-49.el9_0.1
vsftpd-debugsource
Red Hat:rhel_e4s:9.0::appstream
 before 0:3.0.3-49.el9_0.1
0:3.0.3-49.el9_0.1
vsftpd
Red Hat:rhel_aus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debuginfo
Red Hat:rhel_aus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debugsource
Red Hat:rhel_aus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd
Red Hat:rhel_e4s:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debuginfo
Red Hat:rhel_e4s:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debugsource
Red Hat:rhel_e4s:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd
Red Hat:rhel_tus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debuginfo
Red Hat:rhel_tus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd-debugsource
Red Hat:rhel_tus:8.6::appstream
 before 0:3.0.3-35.el8_6.1
0:3.0.3-35.el8_6.1
vsftpd
Red Hat:enterprise_linux_eus:10.0
 before 0:3.0.5-9.el10_0.1
0:3.0.5-9.el10_0.1
vsftpd-debuginfo
Red Hat:enterprise_linux_eus:10.0
 before 0:3.0.5-9.el10_0.1
0:3.0.5-9.el10_0.1
vsftpd-debugsource
Red Hat:enterprise_linux_eus:10.0
 before 0:3.0.5-9.el10_0.1
0:3.0.5-9.el10_0.1
vsftpd
Red Hat:rhel_e4s:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd-debuginfo
Red Hat:rhel_e4s:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd-debugsource
Red Hat:rhel_e4s:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd
Red Hat:rhel_tus:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd-debuginfo
Red Hat:rhel_tus:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd-debugsource
Red Hat:rhel_tus:8.8::appstream
 before 0:3.0.3-35.el8_8.1
0:3.0.3-35.el8_8.1
vsftpd
Rocky Linux:9
 before 0:3.0.5-6.el9_7.2
0:3.0.5-6.el9_7.2
vsftpd
Rocky Linux:10
 before 0:3.0.5-10.el10_1.1
0:3.0.5-10.el10_1.1
vsftpd
Rocky Linux:8
 before 0:3.0.3-36.el8_10.3
0:3.0.3-36.el8_10.3

History

History
RecordedChangedSources
factsCVE List, EUVD
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-14242 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published January 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.81%, the 57th percentile. Fixed in vsftpd 3.0.5-6.el9_7.2.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open