CVE-2021-47865CWE-770

ProFTPD 1.3.7a - Remote Denial of Service

High · published January 21, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
47.9
In the wild
Unconfirmed
What it is

⚡ ProFTPD 1.3.7a has a vulnerability that’s a bit like a party crasher—one with an endless supply of friends! 🎉 Imagine hosting a gathering and suddenly being swarmed by a group of uninvited guests who hog all the space and resources, leaving your legitimate guests out in the cold. That’s exactly what happens here as attackers flood the server with simultaneous FTP connections, ultimately rendering it inaccessible for genuine users. An attacker could easily overwhelm the server, forcing it to reject legitimate connections, which can lead to downtime and frustration for users who rely on FTP access. This denial of service can severely disrupt operations, making it an urgent issue to tackle!

Put simply

Imagine hosting a gathering and suddenly being swarmed by a group of uninvited guests who hog all the space and resources, leaving your legitimate guests out in the cold. That’s exactly what happens here as attackers flood the server with simultaneous FTP connections, ultimately rendering it inaccessible for genuine users. This denial of service vulnerability allows multiple simultaneous FTP connections to overwhelm the server’s limits, effectively blocking access for legitimate users. The exploitation occurs through threading techniques that establish persistent connections.

What to do

An attacker could easily overwhelm the server, forcing it to reject legitimate connections, which can lead to downtime and frustration for users who rely on FTP access. This denial of service can severely disrupt operations, making it an urgent issue to tackle! To address this, update ProFTPD to version 1.3.7b or higher immediately. You should also consider implementing connection limits and monitoring your server traffic to mitigate any potential abuse. Don’t forget to review your server settings for optimal protection! You've got this! By taking these steps, you can ensure your server remains a welcoming space for everyone! 🛡️

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00597 · 47.9th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-01-21T17:27Z
EPSS history
Timeline
  • 21 JAN 17:27Z
    ProFTPD 1.3.7a - Remote Denial of Service
    cvelistv5