CVE-2021-47865

ProFTPD 1.3.7a - Remote Denial of Service

CVSS 8.7 HIGHEPSS 0.5%CWE-770

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.7EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

21 Jan 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly establish connections using threading to exhaust server connection limits and block legitimate user access.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Affected products

ProFTPD · ProFTPD

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/proftpd/proftpd/issues/1298 https://www.exploit-db.com/exploits/49697 https://www.vulncheck.com/advisories/proftpd-a-remote-denial-of-service http://www.proftpd.org/