The CVE description explicitly names ftp_STOU in FTPServer.py as the vulnerable function. The vulnerability stems from an unlimited retry loop for filename generation, confirmed by: 1) The GitHub advisory's description of infinite attempts 2) The original issue #25 discussing the lack of max attempts 3) Historical references to r=37 commit modifying STOU logic 4) CWE-770 classification matching unbounded resource allocation patterns. The function's role in handling STOU commands and generating unique filenames makes it the clear entry point for this DoS vector.