CVE-2021-40524

In Pure-FTPd before 1.0.50, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size, which may lead to denial of service or a server hang. This occurs because a certain greater-than-zero test does not anticipate an initial -1 value. (Versions 1.0.23 through 1.0.49 are affected.)

• CWE-434

• https://github.com/jedisct1/pure-ftpd/commit/37ad222868e52271905b94afea4fc780d83294b4Patch, Third Party Advisory
• https://github.com/jedisct1/pure-ftpd/compare/1.0.49...1.0.50Patch, Third Party Advisory
• https://github.com/jedisct1/pure-ftpd/pull/158Exploit, Third Party Advisory
• https://github.com/jedisct1/pure-ftpd/commit/37ad222868e52271905b94afea4fc780d83294b4Patch, Third Party Advisory
• https://github.com/jedisct1/pure-ftpd/compare/1.0.49...1.0.50Patch, Third Party Advisory
• https://github.com/jedisct1/pure-ftpd/pull/158Exploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/11/msg00003.html

Published

Sep 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-40518Airangel HSMX Gateway devices through 5.2.04 allow CSRF.6.5
• CVE-2021-40519Airangel HSMX Gateway devices through 5.2.04 have Hard-coded…10
• CVE-2021-4052Use after free in web apps in Google Chrome prior to 96.0.46…8.8
• CVE-2021-40520Airangel HSMX Gateway devices through 5.2.04 have Weak SSH C…9.8
• CVE-2021-40521Airangel HSMX Gateway devices through 5.2.04 allow Remote Co…9.8
• CVE-2021-40523In Contiki 3.0, Telnet option negotiation is mishandled. Dur…7.5
• CVE-2021-40525Apache James ManagedSieve implementation alongside with the …9.1
• CVE-2021-40526Incorrect calculation of buffer size vulnerability in Peleto…5.3
• CVE-2021-40527Exposure of senstive information to an unauthorised actor in…7.5
• CVE-2021-40528The ElGamal implementation in Libgcrypt before 1.9.4 allows …5.9
• CVE-2021-40529The ElGamal implementation in Botan through 2.18.1, as used …5.9
• CVE-2021-4053Use after free in UI in Google Chrome on Linux prior to 96.0…8.8