CVE-2009-5011: pyftpdlib FTPHandler Class Race Condition Denial of Service
Summary
CVE-2009-5011: Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading... Affects pyftpdlib versions < 0.5.2. Fixed in 0.5.2. How to fix ↓
Also tracked for
- python-pyftpdlib · Debian:11
The same CVE-2009-5011 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pyftpdlib is a Python FTP server library that provides a high-level interface for implementing FTP servers. It allows developers to create custom FTP servers with ease. The FTPHandler class in pyftpdlib is responsible for handling FTP connections and managing client requests. However, versions before 0.5.2 are vulnerable to a race condition that can lead to a denial of service (daemon outage) when a remote attacker establishes and immediately closes a TCP connection. This vulnerability is different from CVE-2010-3494.
Vulnerability Detail
The vulnerability in pyftpdlib arises due to a race condition in the FTPHandler class. When a remote attacker establishes and quickly closes a TCP connection, it triggers the getpeername function to encounter an ENOTCONN error. This error causes the FTP server daemon to crash, resulting in a denial of service. The impact of this vulnerability is a temporary outage of the FTP server, rendering it inaccessible to legitimate users. It is important to note that this vulnerability is distinct from CVE-2010-3494.
How To Fix
Latest published version: 2.2.0 as of 23 Oct 2026
pip install --upgrade "pyftpdlib==2.2.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.2
This is the first release that contains the fix.
pip install --upgrade "pyftpdlib==0.5.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can implement network-level protections such as firewalls or intrusion prevention systems (IPS) to filter and block malicious TCP connections. Additionally, monitoring tools can be employed to detect and mitigate any potential denial of service attacks targeting the FTP server.
Conclusion
The pyftpdlib FTPHandler class in versions before 0.5.2 is vulnerable to a race condition that can result in a denial of service. To mitigate this issue, it is crucial to upgrade pyftpdlib to version 0.5.2 or later. Implementing network-level protections and monitoring tools can provide additional security against potential attacks. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pyftpdlib →
FAQ
pyftpdlib is a Python FTP server library that allows developers to create custom FTP servers.
The vulnerability is a race condition in the FTPHandler class that can lead to a denial of service.
The vulnerability can be fixed by upgrading pyftpdlib to version 0.5.2 or later.
The vulnerability can cause a temporary outage of the FTP server, rendering it inaccessible to legitimate users.
Yes, users can implement network-level protections and monitoring tools to mitigate potential denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for pyftpdlib.
