High severity · published Jan 21, 2026
CVE-2021-47865
ProFTPD 1.3.7a - Remote Denial of Service
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Attackers can repeatedly establish connections using threading to exhaust server connection limits and block legitimate user access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
ProFTPD · ProFTPD
1.3.7a · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47865
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47865
www.proftpd.org
http://www.proftpd.org/
github.com
https://github.com/proftpd/proftpd/issues/1298
www.exploit-db.com
https://www.exploit-db.com/exploits/49697
www.vulncheck.com
https://www.vulncheck.com/advisories/proftpd-a-remote-denial-of-service
More from ProFTPD
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2010-20103
ProFTPD 1.3.3c Backdoor Command Execution
9.8
CVE-2019-12815
An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication, a related issue to…
8.8
CVE-2026-63090
ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly
8.8
CVE-2020-9273
In ProFTPD 1.3.7, it is possible to corrupt the memory pool by interrupting the data transfer channel