{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25654 exists.","fix":"No fix has been published for CVE-2019-25654 yet. Limit exposure of the affected software until one is available.","what":"CVE-2019-25654 is a high-severity memory corruption vulnerability in Coreftp Core FTP/SFTP Server, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2019-25654 and fix it if it is affected.\n\nWhat it is: CVE-2019-25654 is a high-severity memory corruption vulnerability in Coreftp Core FTP/SFTP Server, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-25654 exists.\n\nAffected product: Coreftp Core FTP/SFTP Server. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2019-25654/ (Markdown: https://insights.sbomify.com/CVE-2019-25654/index.md)","id":"CVE-2019-25654","markdown":"https://insights.sbomify.com/CVE-2019-25654/index.md","name":"CVE-2019-25654","record":{"aliases":["GHSA-rj7r-w646-cjw4"],"analysis":{"component_type":"server_software","fix_type":"no_fix_stated","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"FTP/SFTP server","requires_auth":"none","summary":"Attackers can crash the Core FTP/SFTP Server by sending an excessively long string in the User domain field, causing a denial of service.","user_interaction":"not_required","vuln_class":"memory_corruption"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[{"product":"core_ftp","vendor":"coreftp"}],"cvss":{"score":8.7,"severity":"high","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"description":"Core FTP/SFTP Server 1.2 contains a buffer overflow vulnerability that allows attackers to crash the service by supplying an excessively long string in the User domain field. Attackers can paste a malicious payload containing 7000 bytes of data into the domain configuration to trigger an application crash and deny service.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"weaponised"},"has_fix":null,"headline":"Core FTP/SFTP Server 1.2 Denial of Service via Buffer Overflow","id":"CVE-2019-25654","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"memory_corruption","year":"2019"},"n_packages":0,"n_references":4,"next":{"headline":"Device Monitoring Studio 8.10.00.8925 Denial of Service","id":"CVE-2019-25655"},"packages":[],"prev":{"headline":"Navicat for Oracle 12.1.15 Password Field Denial of Service","id":"CVE-2019-25653"},"products":["Core FTP/SFTP Server"],"published":"2026-03-30","related":[{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2020-19596","kev_date_added":null,"published":"2021-04-05"},{"cvss_score":9.8,"headline":"Memory corruption in n/a","id":"CVE-2018-12113","kev_date_added":null,"published":"2018-07-05"},{"cvss_score":9.3,"headline":"Memory corruption in n/a","id":"CVE-2013-3930","kev_date_added":null,"published":"2014-04-04"},{"cvss_score":9.3,"headline":"Memory corruption in n/a","id":"CVE-2009-3484","kev_date_added":null,"published":"2009-09-30"},{"cvss_score":8.7,"headline":"Core FTP 2.0 build 653 PBSZ Unauthenticated Denial of Service","id":"CVE-2019-25686","kev_date_added":null,"published":"2026-04-05"},{"cvss_score":7.8,"headline":"Memory corruption in n/a","id":"CVE-2014-1215","kev_date_added":null,"published":"2018-03-20"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"poc","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-27","vendors":["Coreftp"]},"summary":"Attackers can crash the Core FTP/SFTP Server by sending an excessively long string in the User domain field, causing a denial of service.","url":"https://insights.sbomify.com/CVE-2019-25654/"}