BulletProof FTP Server version 2019.0.0.50 has a flaw in the SMTP configuration interface that allows a malicious user to crash the application. By entering an overly long string—a buffer of 257 'A' characters—in the SMTP Server field and triggering the Test button, the program fails, resulting in a denial of service for the local user. This weakness is classified as CWE-1282, a local input validation vulnerability that impacts application availability. The impact is limited to consumers of the FTP service; once the crash occurs, the server stops servicing requests until restarted, disrupting legitimate users.

The vulnerability is known to affect the BulletProof FTP Server product of Bpftpserver, specifically release 2019.0.0.50. No other versions or products are listed as affected in the data provided.

The CVSS score of 6.8 places this issue in the medium severity range, with an EPSS value below 1% indicating that widespread exploitation is currently unlikely. The vulnerability is not part of the CISA KEV catalog. Exploitation requires local access to the hosting machine or to the FTP server’s configuration interface; an attacker would supply the oversized string to trigger the crash. Because the attack is local and does not propagate remotely, the risk to external systems is reduced, but any attacker with local privileges could still disrupt service.