CVE-2008-1052: Netwin Surgeftp

Medium severity, CVSS 6.4. EPSS: 6.8% chance of exploitation in the next 30 days.

The administration web interface in NetWin SurgeFTP 2.3a2 and earlier allows remote attackers to cause a denial of service (daemon crash) via a large integer in the Content-Length HTTP header, which triggers a NULL pointer dereference when memory allocation fails.

Affected products

• Netwin Surgeftp: version 2.3a2 only

Published 2008-02-27. Last modified 2026-06-16.