CVE-2021-40524: 
Pure-FTPd vulnerability analysis and mitigation

In Pure-FTPd versions 1.0.23 through 1.0.49, an incorrect max_filesize quota mechanism in the server allows attackers to upload files of unbounded size. This vulnerability was discovered in September 2021 and assigned CVE-2021-40524. The issue occurs because a certain greater-than-zero test does not anticipate an initial -1 value (CVE Mitre).

The vulnerability stems from a logic flaw in the quota checking mechanism where the predicate (maxfilesize >= (offt) 0 && (maxfilesize = userquotasize - quota.size) < (offt) 0) never evaluates to true because maxfilesize is initially set to -1. When max_filesize >= (offt) 0 evaluates to false, the subsequent predicate is not evaluated, leaving max_filesize at -1 indefinitely. This results in no overflow detection even when quotas are exceeded (GitHub PR).

The vulnerability may lead to denial of service or server hang conditions as attackers can upload files of unbounded size, potentially exhausting server resources (NVD).

The vulnerability was fixed in Pure-FTPd version 1.0.50 with commit 37ad222. The fix involves correcting the predicate order to ensure proper quota checking by evaluating maxfilesize = userquota_size - quota.size first (GitHub Commit).