CVE-2026-44240: basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering
Vulnerability summary
CVE-2026-44240 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in patrickjuchli basic-ftp. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities.
Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 12-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
Decrease -0.03 pp
From 0.54% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard38 products
- code-server< 4.112.0-r4
- kibana-7All versions (No fix recorded)
- kibana-8.17< 8.17.10-r21
- kibana-8.17-bitnami< 8.17.10-r21
- kibana-8.17-iamguarded< 8.17.10-r21
Debian1 product
- node-proxy-agentsAll versions (No fix recorded) | < 0~2025070717+~cs15.3.8-1
Npm1 product
- basic-ftp< 5.3.1
Patrickjuchli1 product
- basic-ftp< 5.3.1
Ubuntu1 product
- node-proxy-agentsAll versions (No fix recorded)
Wolfi1 product
- code-server< 4.112.0-r4
6 vendors · 43 products
References
7 links- github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89X Refsource CONFIRMREPORTAdvisoryWEB
