CVE-2026-41324 — Uncontrolled Resource Consumption in Basic-ftp

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or Throttling3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 87.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Patrickjuchli Basic-ftpAnsible-automation-platform Automation-portalOpenshift4 Ose-console-rhel9+3 more
Timeline
PublishedApr 24

Description

basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages6 packages

▶CVEListV5patrickjuchli/basic-ftp< 5.3.0
▶Red Hatrust-lang/rust

📋Vendor Advisories

1
Red Hat
basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings↗2026-04-24
▶

💬Community

1
Bugzilla
CVE-2026-41324 basic-ftp: basic-ftp: Denial of Service via unbounded memory growth from malicious directory listings↗2026-04-24
▶