CVE-2020-9273

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer...

8.8 HighPublic exploitFix available

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

11.8%Down 5.5 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: CVE-2020-9273
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Weakness: CWE-416
Updated: 2026-11-02

CVE List No score

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: CVE-2020-9273
Updated: 2026-11-02

EUVDEUVD-2020-30102 No score

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: EUVD-2020-30102
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j879-hg9w-v5qv No score

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer...

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: GHSA-j879-hg9w-v5qv
Weakness: CWE-416
Updated: 2026-11-02

OSV 8.8

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: CVE-2020-9273
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-9273 8.8

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: DEBIAN-CVE-2020-9273
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVUBUNTU-CVE-2020-9273 8.8

In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c, and possible remote code execution.

Record: UBUNTU-CVE-2020-9273
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2020-0120 No score

Updated proftpd packages fix security vulnerability

Updated proftpd packages fix security vulnerability:

Antonio Morales discovered an use-after-free flaw in the memory pool allocator in ProFTPD. Interrupting current data transfers can corrupt the ProFTPD memory pool, leading to denial of service, or potentially the execution of arbitrary code (CVE-2020-9273).

Record: MGASA-2020-0120
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0273-1 No score

Security update for proftpd

This update for proftpd fixes the following issues:

proftpd was updated to version 1.3.6c.

Security issues fixed:

CVE-2020-9272: Fixed an out-of-bounds read in mod_cap (bsc#1164572).
CVE-2020-9273: Fixed a potential memory corruption caused by an interruption of the data transfer channel (bsc#1164574).

Record: openSUSE-SU-2020:0273-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11196-1 No score

proftpd-1.3.6e-1.10 on GA media

These are all security issues fixed in the proftpd-1.3.6e-1.10 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11196-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`proftpd-dfsg` Debian:12	before 1.3.6c-2	1.3.6c-2
`proftpd-dfsg` Debian:13	before 1.3.6c-2	1.3.6c-2
`proftpd-dfsg` Debian:14	before 1.3.6c-2	1.3.6c-2
`proftpd-dfsg` Debian:8	before 1.3.5e+r1.3.5-2+deb8u6, plus listed versions 1.3.5-1.11.3.5-1.1+deb8u11.3.5-1.1+deb8u21.3.5-21.3.5a-1 Show 12 moreShow less 1.3.5b-11.3.5b-21.3.5b-31.3.5b-41.3.5d-11.3.5e+r1.3.5-2+deb8u11.3.5e+r1.3.5-2+deb8u21.3.5e+r1.3.5-2+deb8u31.3.5e+r1.3.5-2+deb8u41.3.5e+r1.3.5-2+deb8u51.3.5e-0+deb8u11.3.5e-1	1.3.5e+r1.3.5-2+deb8u6
`proftpd-dfsg` Debian:8	before 1.3.5e+r1.3.5-2+deb8u7, plus listed versions 1.3.5-1.11.3.5-1.1+deb8u11.3.5-1.1+deb8u21.3.5-21.3.5a-1 Show 13 moreShow less 1.3.5b-11.3.5b-21.3.5b-31.3.5b-41.3.5d-11.3.5e+r1.3.5-2+deb8u11.3.5e+r1.3.5-2+deb8u21.3.5e+r1.3.5-2+deb8u31.3.5e+r1.3.5-2+deb8u41.3.5e+r1.3.5-2+deb8u51.3.5e+r1.3.5-2+deb8u61.3.5e-0+deb8u11.3.5e-1	1.3.5e+r1.3.5-2+deb8u7
`proftpd-dfsg` Debian:9	before 1.3.5b-4+deb9u4, plus listed versions 1.3.5b-41.3.5b-4+deb9u11.3.5b-4+deb9u21.3.5b-4+deb9u3	1.3.5b-4+deb9u4
`proftpd-dfsg` Debian:10	before 1.3.6-4+deb10u4, plus listed versions 1.3.6-41.3.6-4+deb10u11.3.6-4+deb10u21.3.6-4+deb10u3	1.3.6-4+deb10u4
`proftpd` Mageia:7	before 1.3.5e-4.3.mga7	1.3.5e-4.3.mga7
`proftpd-dfsg` Ubuntu:16.04:LTS	All versions, plus listed versions 1.3.5-21.3.5a-11.3.5a-1build11.3.5a-1ubuntu0.1	None known
`proftpd-dfsg` Ubuntu:18.04:LTS	All versions, plus listed versions 1.3.5d-11.3.5e-1build1	None known

Show 4 moreShow less

Affected packages
Package	Affected	Fixed
`proftpd` SUSE:Package Hub 15 From an advisory covering 2 CVEs	before 1.3.6c-bp151.4.9.1	1.3.6c-bp151.4.9.1
`proftpd` SUSE:Package Hub 15 SP1 From an advisory covering 2 CVEs	before 1.3.6c-bp151.4.9.1	1.3.6c-bp151.4.9.1
`proftpd` openSUSE:Leap 15.1 From an advisory covering 2 CVEs	before 1.3.6c-bp151.4.9.1	1.3.6c-bp151.4.9.1
`proftpd` openSUSE:Tumbleweed From an advisory covering 7 CVEs	before 1.3.6e-1.10	1.3.6e-1.10

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	dukptkey/CVE-2020-9273	2020-11-05

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-9273 is a high vulnerability (CVSS 8.8) in Proftpd, published February 20, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.8%, the 96th percentile. Fixed in proftpd-dfsg 1.3.6c-2.

References

Show 27 moreShow less