CVE-2007-6740: pyftpdlib FTPServer.py STOU Command Denial of Service
Summary
CVE-2007-6740: The ftp_STOU function in FTPServer.py in pyftpdlib before 0.2.0 does not limit the number of attempts to discover a unique filename, which might allow remote authenticated users to cause a denial of service via a STOU co... Affects pyftpdlib versions < 0.2.0. Fixed in 0.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level and convenient interface for implementing FTP servers. It allows users to create custom FTP servers with various features and functionalities. However, versions prior to 0.2.0 are vulnerable to a denial of service (DoS) attack through the STOU command.
Vulnerability Detail
The vulnerability in pyftpdlib arises from the ftp_STOU function in FTPServer.py. This function does not limit the number of attempts to discover a unique filename, which can be exploited by remote authenticated users. By repeatedly sending STOU commands, an attacker can cause a denial of service, potentially disrupting the availability of the FTP server. This vulnerability has been assigned the identifier CVE-2007-6740.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "pyftpdlib==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.2.0
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.2.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of pyftpdlib as soon as possible.
Conclusion
The vulnerability in pyftpdlib's FTPServer.py allows remote authenticated users to cause a denial of service through the STOU command. To mitigate this vulnerability, it is crucial to upgrade pyftpdlib to version 0.2.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows users to create custom FTP servers with various features and functionalities.
The vulnerability in pyftpdlib can be exploited by remote authenticated users to cause a denial of service, potentially disrupting the availability of the FTP server.
To fix this vulnerability, it is recommended to upgrade pyftpdlib to version 0.2.0 or later. Instructions for upgrading can be found in the 'how_to_fix' section.
There is no known workaround for this vulnerability. It is strongly advised to upgrade to the fixed version of pyftpdlib.
For more information about this vulnerability, you can refer to the CVE identifier CVE-2007-6740 or the provided source link in the 'affected' section of the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
