← Database

CVE-2021-40524

HIGH CVSS: 7.5 Published: 2021-09-05 Modified: 2026-06-17

Description

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

Affected Platforms

Pureftpd Pure-Ftpd

Weakness Type

CWE-434

References