CVE-2011-0762

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote...

4.0 MediumPublic exploitFix available

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.

Exploit likelihood

73.9%Up 62.9 points since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2011-0762
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-400
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-0762
Updated: 2026-11-02

EUVDEUVD-2011-0774 No score

Record: EUVD-2011-0774
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jh3r-4mfv-pjv8 No score

The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote...

Record: GHSA-jh3r-4mfv-pjv8
Weakness: CWE-400
Updated: 2026-11-02

OSV No score

Record: CVE-2011-0762
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-0762 No score

Record: DEBIAN-CVE-2011-0762
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`vsftpd` Debian:12	before 2.3.4-1	2.3.4-1
`vsftpd` Debian:13	before 2.3.4-1	2.3.4-1
`vsftpd` Debian:14	before 2.3.4-1	2.3.4-1
`vsftpd` Debian:6.0	before 2.3.2-3+squeeze2, plus listed versions 2.3.2-3	2.3.2-3+squeeze2
`vsftpd` Debian:5.0	before 2.0.7-1+lenny1, plus listed versions 2.0.7-1	2.0.7-1+lenny1
`vsftpd` Red Hat:enterprise_linux:4::as	before 0:2.0.1-9.el4	0:2.0.1-9.el4
`vsftpd-debuginfo` Red Hat:enterprise_linux:4::as	before 0:2.0.1-9.el4	0:2.0.1-9.el4
`vsftpd` Red Hat:enterprise_linux:4::es	before 0:2.0.1-9.el4	0:2.0.1-9.el4
`vsftpd-debuginfo` Red Hat:enterprise_linux:4::es	before 0:2.0.1-9.el4	0:2.0.1-9.el4
`vsftpd` Red Hat:enterprise_linux:5::server	before 0:2.0.5-16.el5_6.1	0:2.0.5-16.el5_6.1

Show 5 moreShow less

Affected packages
Package	Affected	Fixed
`vsftpd-debuginfo` Red Hat:enterprise_linux:5::server	before 0:2.0.5-16.el5_6.1	0:2.0.5-16.el5_6.1
`vsftpd` Red Hat:enterprise_linux:6::server	before 0:2.2.2-6.el6_0.1	0:2.2.2-6.el6_0.1
`vsftpd-debuginfo` Red Hat:enterprise_linux:6::server	before 0:2.2.2-6.el6_0.1	0:2.2.2-6.el6_0.1
`vsftpd` Red Hat:enterprise_linux:6::workstation	before 0:2.2.2-6.el6_0.1	0:2.2.2-6.el6_0.1
`vsftpd-debuginfo` Red Hat:enterprise_linux:6::workstation	before 0:2.2.2-6.el6_0.1	0:2.2.2-6.el6_0.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	vsftpd 2.3.2 - Denial of Service	2011-03-02
Metasploit	VSFTPD 2.3.2 and Earlier STAT Denial of Service	2011-02-03
Nuclei	vsftpd < 2.3.3 - DoS
PoC in GitHub	s3mPr1linux/CVE-2011-0762	2025-05-19

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-0762 is a medium vulnerability (CVSS 4.0) in Vsftpd Project Vsftpd, published March 2, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 73.9%, the 99th percentile. Fixed in vsftpd 2.3.4-1.

References

Show 27 moreShow less