CVE-2021-47865: 
ProFTPd vulnerability analysis and mitigation

CVE-2021-47865 is a denial-of-service (DoS) vulnerability in ProFTPD 1.3.7a caused by improper allocation of resources without limits or throttling. Attackers can overwhelm the server by creating multiple simultaneous FTP connections using threading to exhaust server connection limits, blocking legitimate user access. The vulnerability was originally reported as a GitHub issue in August 2021 and formally assigned a CVE and published on January 21, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High), both assigned by VulnCheck (VulnCheck Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning ProFTPD 1.3.7a does not adequately enforce per-IP or global connection rate limits. An unauthenticated remote attacker can exploit this by spawning a large number of concurrent TCP connections to the FTP port using multi-threaded tooling, exhausting the server's configured maximum connection allowance. No authentication or special privileges are required, and no user interaction is needed. The vulnerability was originally surfaced via a Black Duck Security Advisory tool and reported in the ProFTPD GitHub issue tracker (GitHub Issue #1298, VulnCheck Advisory).

Successful exploitation results in a complete denial of service for the FTP server, preventing legitimate users from establishing new connections for the duration of the attack. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected deployments include any system running ProFTPD 1.3.7a that is network-accessible, particularly those without upstream connection-limiting controls (Red Hat Bugzilla, VulnCheck Advisory).

A proof-of-concept exploit is publicly available on Exploit-DB (exploit ID 49697), referenced directly in the CVE record (VulnCheck Advisory). However, there is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.041%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing ProFTPD servers running version 1.3.7a using tools such as Shodan or Censys by searching for FTP banners disclosing the ProFTPD version.
2. Establish baseline: Connect to the target FTP server (port 21 by default) and confirm the server banner identifies ProFTPD 1.3.7a.
3. Launch connection flood: Using a multi-threaded script or the publicly available Exploit-DB PoC (exploit ID 49697), spawn a large number of simultaneous TCP connections to the FTP port, rapidly consuming the server's maximum allowed connection slots.
4. Sustain exhaustion: Maintain the connections open (or continuously re-establish them) to prevent the server from freeing slots, causing new legitimate connection attempts to be refused.
5. Verify impact: Attempt a legitimate FTP connection from a separate host — the server should return a connection refused or maximum connections exceeded error, confirming denial of service (Exploit-DB, GitHub Issue #1298).

• Network: Sudden spike in concurrent TCP connections to port 21 from one or more source IPs; connection count approaching or exceeding the configured MaxInstances or MaxConnectionsPerHost limit on the ProFTPD server.
• Logs: ProFTPD transfer logs (/var/log/proftpd/proftpd.log) showing repeated connection attempts from the same IP or IP range with no successful authentication; log entries indicating "maximum number of connections" reached.
• Process: Unusually high number of proftpd child processes visible via ps aux or system monitoring tools, consistent with connection slot exhaustion.
• Availability: FTP service becomes unresponsive or returns connection errors to legitimate clients during the attack window (GitHub Issue #1298, VulnCheck Advisory).

No specific patched version of ProFTPD has been formally identified as resolving this issue; patch availability for version 1.3.7a remains unclear. Administrators should implement the following mitigations: configure MaxInstances and MaxConnectionsPerHost directives in proftpd.conf to limit connections per IP; deploy network-level rate limiting or DDoS mitigation upstream of the FTP server; use firewall rules (e.g., iptables with --connlimit) to restrict the number of simultaneous connections per source IP; and monitor for anomalous connection patterns. Upgrading to the latest ProFTPD release (v1.3.9b as of June 2026) is recommended as a general best practice (Red Hat Bugzilla, ProFTPD GitHub).

Red Hat has tracked this vulnerability via its Bugzilla system (Bug 2431679) with a high severity rating, though no Red Hat products have been confirmed as directly affected. The vulnerability was originally flagged by Black Duck's security advisory tooling and reported by a community member in the ProFTPD GitHub issue tracker in August 2021, with formal CVE assignment occurring over four years later in January 2026. No significant broader media coverage or notable researcher commentary beyond the initial issue report has been identified (GitHub Issue #1298, Red Hat Bugzilla).