Denial of Service Vulnerability in vsftpd Package - Security Update Required
Summary
ALSA-2026:0605: Moderate: vsftpd security update. Affects vsftpd versions < 3.0.5-6.el9_7.2. Fixed in 3.0.5-6.el9_7.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vsftpd (Very Secure File Transfer Protocol Daemon) is a widely used FTP server for Unix-like systems, known for its security and performance. It is designed to handle file transfers over a network securely and efficiently. However, a recent vulnerability has been identified that could potentially allow an attacker to exploit the server's functionality, leading to a denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2025-14242, arises from an integer overflow in the parsing of the 'ls' command parameters within vsftpd. This flaw can be exploited by an attacker to cause a denial of service, rendering the FTP server unresponsive. The impact of this vulnerability is significant, as it can disrupt file transfer services and affect the availability of resources for users relying on the FTP server.
How To Fix
Minimum fixed version
3.0.5-6.el9_7.2
This is the first release that contains the fix.
sudo dnf update vsftpdTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the vsftpd service by configuring firewall rules to restrict incoming connections or by disabling the service until the update can be applied. This can be done using the command:
sudo systemctl stop vsftpd' to stop the service.
Conclusion
The vsftpd package has a critical vulnerability that can lead to denial of service. Users are urged to update to the latest patched version to mitigate risks. Regular monitoring and updates are essential for maintaining security in software applications.
See every vulnerability recorded for vsftpd →
FAQ
vsftpd is a secure and efficient FTP server for Unix-like systems, designed to handle file transfers over a network.
CVE-2025-14242 refers to a specific vulnerability in vsftpd that allows for a denial of service due to an integer overflow in command parameter parsing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploiting this vulnerability can lead to a denial of service, making the FTP server unresponsive and disrupting file transfer services.
It is recommended to regularly check for updates and apply them promptly to ensure that your vsftpd package is secure and free from known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for vsftpd.
