https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:18:47 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0627 certfr-2026-avi-0627 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0627 https://cve.radiocsirt.org/vuln/cleanstart-2026-lz49764 <p><strong>Affected:</strong> CleanStart: proxy-agent</p> <p>CVE-2026-41324 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: proxy-agent</p> <p>CVE-2026-41324 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-lz49764 https://cve.radiocsirt.org/vuln/euvd-2026-292965 EUVD-2026-292965 https://cve.radiocsirt.org/vuln/euvd-2026-292965 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41324 <p>basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.</p> <p>basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41324 https://cve.radiocsirt.org/vuln/ghsa-rp42-5vxx-qpwr <p><strong>Affected:</strong> npm: basic-ftp</p> <p>### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.</p> <p>### Details The issue is in the package&#39;s default directory listing flow.</p> <p>`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:</p> <p>File: `dist/Client.js:516-527`</p> <p>```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: &#34;&#34;, type: &#34;list&#34; }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```</p> <p>The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:</p> <p>File: `dist/StringWriter.js:5-20`</p> <p>```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error(&#34;StringWriter expects chunks…</p> <p><strong>Affected:</strong> npm: basic-ftp</p> <p>### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.</p> <p>### Details The issue is in the package&#39;s default directory listing flow.</p> <p>`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:</p> <p>File: `dist/Client.js:516-527`</p> <p>```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: &#34;&#34;, type: &#34;list&#34; }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```</p> <p>The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:</p> <p>File: `dist/StringWriter.js:5-20`</p> <p>```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error(&#34;StringWriter expects chunks…</p> https://cve.radiocsirt.org/vuln/ghsa-rp42-5vxx-qpwr https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41324 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-proxy-agents, Ubuntu:25.10: node-proxy-agents, Ubuntu:26.04:LTS: node-proxy-agents</p> <p>basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-proxy-agents, Ubuntu:25.10: node-proxy-agents, Ubuntu:26.04:LTS: node-proxy-agents</p> <p>basic-ftp is an FTP client for Node.js. Versions prior to 5.3.0 are vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes. Version 5.3.0 fixes the issue.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41324 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1833 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM App Connect Enterprise ausnutzen, um Dateien zu manipulieren oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1833