Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-eq37-ztb2-nfb8
Vulnerability ID VCID-eq37-ztb2-nfb8
Aliases CVE-2021-40491
Summary The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk None
Affected and Fixed Packages Package Details
Weaknesses (0)
There are no known CWE.
System Score Found at
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
epss 0.00339 https://api.first.org/data/v1/epss?cve=CVE-2021-40491
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-40491
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40491
993476 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=993476
USN-USN-5177-1 https://usn.ubuntu.com/USN-5177-1/
No exploits are available.
There are no known vectors.
Exploit Prediction Scoring System (EPSS)
Percentile 0.56551
EPSS Score 0.00339
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T16:35:03.560607+00:00 Debian Oval Importer Import https://www.debian.org/security/oval/oval-definitions-bullseye.xml.bz2 38.0.0