CVE catalog

CVE-2021-40524

pure-ftpd: CVE-2021-40524

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
4.29% · Oct 25, 2026

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpure-ftpdsid1.0.50-2.3fixed
Debianpure-ftpdtrixie1.0.50-2.2fixed
Debianpure-ftpdbookworm1.0.50-2.1fixed
Ubuntupure-ftpd16.041.0.36-3.2vulnerable
Ubuntupure-ftpd16.041.0.36-3.2build1vulnerable
Ubuntupure-ftpd16.041.0.36-3.2+deb8u1build0.16.04.1vulnerable
Ubuntupure-ftpd18.041.0.46-1vulnerable
Ubuntupure-ftpd18.041.0.46-1build1vulnerable
Ubuntupure-ftpd18.041.0.46-1ubuntu18.04.1vulnerable
Ubuntupure-ftpd20.041.0.47-3build1vulnerable
Ubuntupure-ftpd20.041.0.49-1vulnerable
Ubuntupure-ftpd20.041.0.49-2vulnerable
Ubuntupure-ftpd20.041.0.49-3vulnerable
Ubuntupure-ftpd20.041.0.49-4vulnerable
Ubuntupure-ftpd20.041.0.49-4ubuntu0.1vulnerable
Ubuntupure-ftpd22.041.0.49-4.1build1vulnerable
Ubuntupure-ftpd22.041.0.50-2vulnerable
Ubuntupure-ftpd22.041.0.50-2.1vulnerable
Ubuntupure-ftpd22.041.0.50-2.1ubuntu0.22.04.1vulnerable
Ubuntupure-ftpd24.041.0.50-2.1build1vulnerable
Ubuntupure-ftpd24.041.0.50-2.1ubuntu1vulnerable
Ubuntupure-ftpd24.041.0.50-2.2vulnerable
Ubuntupure-ftpd24.041.0.50-2.2build1vulnerable
Ubuntupure-ftpd24.041.0.50-2.2build2vulnerable
Ubuntupure-ftpd25.101.0.50-2.2build3vulnerable
Ubuntupure-ftpd26.041.0.50-2.2build3vulnerable
Ubuntupure-ftpd26.041.0.50-2.2build4vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpure-ftpdsourcesid1.0.50-1not yet assignedNot reported[993810]
Debianpure-ftpdsourcetrixie1.0.50-1not yet assignedNot reported[993810]
Debianpure-ftpdsourcebookworm1.0.50-1not yet assignedNot reported[993810]

[Debian bug #993810]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [pure-ftpd]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

    • 1.0.50-2.1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

  • [pure-ftpd-common]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.1 · all · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

    • 1.0.50-2.1 · all · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

  • [pure-ftpd-ldap]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

    • 1.0.50-2.1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

  • [pure-ftpd-mysql]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

    • 1.0.50-2.1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

  • [pure-ftpd-postgresql]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.1+b2 · amd64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

    • 1.0.50-2.1+b2 · arm64 · bookworm

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · bookworm; dsa · pure-ftpd · debian · 12

[Debian 13 (Trixie)]

  • [pure-ftpd]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.2+b2 · amd64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

    • 1.0.50-2.2+b2 · arm64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

  • [pure-ftpd-common]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.2 · all · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

    • 1.0.50-2.2 · all · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

  • [pure-ftpd-ldap]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.2+b2 · amd64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

    • 1.0.50-2.2+b2 · arm64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

  • [pure-ftpd-mysql]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.2+b2 · amd64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

    • 1.0.50-2.2+b2 · arm64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

  • [pure-ftpd-postgresql]Fixed

    Source package: [pure-ftpd]

    Details (2)

    • 1.0.50-2.2+b2 · amd64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

    • 1.0.50-2.2+b2 · arm64 · trixie

      Fixed · Fixed: 1.0.50-1

      dsa · pure-ftpd · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]