CVE-2011-0418: Netbsd

Medium severity, CVSS 4.0. EPSS: 7.3% chance of exploitation in the next 30 days.

The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.

Affected products

• Netbsd Netbsd: version 5.1 only
• Pureftpd Pure-Ftpd: up to and including 1.0.31; version 0.90 only; version 0.91 only; version 0.92 only; version 0.93 only; version 0.94 only; …

Published 2011-05-24. Last modified 2026-06-16.