mod_radius in ProFTPD prior to 1.3.7c allows memory disclosure to RADIUS servers because it copies blocks of 16 characters.
proftpd proftpd