CVE-2026-41324: basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()
Vulnerability summary
CVE-2026-41324 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in patrickjuchli basic-ftp. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.4% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 24-04-2026PublishedVulnerability first disclosed.
- 24-04-2026Last modifiedVulnerability information updated.
Description
basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
Decrease -0.15 pp
From 0.49% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundBasic Ftp
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard26 products
- code-server< 4.112.0-r3
- kibana-7All versions (No fix recorded)
- kibana-8.17< 8.17.10-r18
- kibana-8.17-bitnami< 8.17.10-r18
- kibana-8.17-iamguarded< 8.17.10-r18
Wolfi2 products
- code-server< 4.112.0-r3
- opensearch-dashboards-3-security-dashboards-plugin< 3.6.0-r0
Debian1 product
- node-proxy-agentsAll versions (No fix recorded) | < 0~2025070717+~cs15.3.7-1
Npm1 product
- basic-ftp< 5.3.0
Patrickjuchli1 product
- basic-ftp< 5.3.0
Ubuntu1 product
- node-proxy-agentsAll versions (No fix recorded)
6 vendors · 32 products
References
7 links- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rp42-5vxx-qpwrX Refsource CONFIRMREPORTAdvisoryWEBExploitMitigationVendor Advisory
