Multiple libc/glob(3) flaws were reported [1] that affect various BSD libc implementations. In particular, globs containing braces could lead to resource exhaustion.
One such vulnerable application is Pure-FTPd. This has been corrected in upstream version 1.0.32, where support for braces expansion in directory listings was disabled.
[1] http://securityreason.com/achievementsecurityalert/97 [2] http://www.pureftpd.org/project/pure-ftpd/news