CVE-2020-36964CWE-787

YATinyWinFTP - Denial of Service

High · published January 28, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

⚡ Just one malformed 272-byte command can bring the entire FTP service crashing down! 🔥 Think of it like a restaurant that shuts down because a customer orders a dish with an extra space on the side—suddenly, the whole kitchen is in chaos because they can't handle that request! An attacker could easily trigger this denial of service vulnerability, causing the FTP service to crash and rendering it unusable. This could lead to significant downtime, leaving users unable to upload or download files when they need them most—an absolute disaster for anyone relying on this service!

Put simply

Think of it like a restaurant that shuts down because a customer orders a dish with an extra space on the side—suddenly, the whole kitchen is in chaos because they can't handle that request! This vulnerability in YATinyWinFTP allows a buffer overflow when the service receives a 272-byte command that includes a trailing space, causing the service to crash when it cannot process the malformed input correctly.

What to do

An attacker could easily trigger this denial of service vulnerability, causing the FTP service to crash and rendering it unusable. This could lead to significant downtime, leaving users unable to upload or download files when they need them most—an absolute disaster for anyone relying on this service! To mitigate this vulnerability, update YATinyWinFTP to the latest version immediately. Also, consider implementing rate limiting on incoming commands to help prevent this type of attack in the future. Don't forget to monitor your logs for any suspicious activity! You've got this! Stay vigilant and secure your service like a pro! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2026-01-28T17:35Z
EPSS history
Timeline
  • 28 JAN 17:35Z
    YATinyWinFTP - Denial of Service
    cvelistv5