Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-20176

CWE-400 — Uncontrolled Resource Consumption10 documents8 sources
Severity
7.5HIGH
EPSS
10.8%
top 6.65%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
2
Fedoraproject FedoraPureftpd Pure-ftpd
Timeline
PublishedDec 31
Latest updateApr 3

Description

In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir function in ls.c.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶Debianpure-ftpd< 1.0.49-2+2
▶NVDpureftpd/pure-ftpd1.0.49

Also affects: Fedora 30, 31

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-fgwh-frh9-vm43: In Pure-FTPd 1↗2022-05-24
▶
OSV
CVE-2019-20176: In Pure-FTPd 1↗2019-12-31
▶
CVEList
CVE-2019-20176: In Pure-FTPd 1↗2019-12-31
▶

💥Exploits & PoCs

2
Exploit-DB
Microsoft Office 2019 MSO Build 1808 - NTLMv2 Hash Disclosure↗2025-04-03
▶
Nuclei
Pure-FTPd < 1.0.50 - DoS via Resource Exhaustion
▶

📋Vendor Advisories

1
Debian
CVE-2019-20176: pure-ftpd - In Pure-FTPd 1.0.49, a stack exhaustion issue was discovered in the listdir func...↗2019
▶

💬Community

3
Bugzilla
CVE-2019-20176 pure-ftpd: stack exhaustion in function listdir in ls.c↗2020-01-27
▶
Bugzilla
CVE-2019-20176 pure-ftpd: stack exhaustion in function listdir in ls.c [fedora-all]↗2020-01-27
▶
Bugzilla
CVE-2019-20176 pure-ftpd: stack exhaustion in function listdir in ls.c [epel-all]↗2020-01-27
▶