Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via v…

published 2011-12-06 14 y ago modified 2026-06-16 4 mo ago also EUVD-2011-4078

cvss: 9.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 12.6%; EPSS 12.6% chance of exploitation in 30 days, percentile 96%
public exploits: 0; none known

Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.

Patch / fix

distros 2 links 1

debian opensuse

proftpd-dfsg Debian 14, Debian 13, Debian 12 1.3.4~rc3-2

debian advisories DEBIAN-CVE-2011-4130

proftpd openSUSE Tumbleweed 1.3.5b-2.5

opensuse advisories openSUSE-SU-2024:10048-1

bugs.proftpd.org/show_bug.cgi?id=3711 patch

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2011-4130 updated 2025-11-21 cvss 6.0

proftpd: Response pool use-after-free flaw (ZDI-CAN-1420)

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

12.63% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.proftpd.org http://bugs.proftpd.org/show_bug.cgi?id=3711 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Classification

Weakness

CWE-399 Resource Management Errors

References

bugs.proftpd.org /show_bug.cgi?id=3711
exploit, patch
zerodayinitiative.com /advisories/ZDI-11-328/
proftpd.org /docs/NEWS-1.3.3g
securityfocus.com /bid/50631
vdb-entry

Sources

CVE List CVE-2011-4130
NVD CVE-2011-4130

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary