https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 22:50:43 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1094 https://cve.radiocsirt.org/vuln/cleanstart-2026-dy27694 <p><strong>Affected:</strong> CleanStart: proxy-agent</p> <p>CVE-2026-44240 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: proxy-agent</p> <p>CVE-2026-44240 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-dy27694 https://cve.radiocsirt.org/vuln/euvd-2026-318447 EUVD-2026-318447 https://cve.radiocsirt.org/vuln/euvd-2026-318447 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44240 <p>basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.</p> <p>basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-44240 https://cve.radiocsirt.org/vuln/ghsa-rpmf-866q-6p89 <p><strong>Affected:</strong> npm: basic-ftp</p> <p>## Summary</p> <p>`basic-ftp` is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses.</p> <p>A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into `FtpContext._partialResponse` and repeatedly reparses the accumulated buffer without enforcing a maximum control response size.</p> <p>As a result, an application using `basic-ftp` can remain stuck in `connect()` while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints.</p> <p>---</p> <p>## Details</p> <p>### Root cause</p> <p>The root cause is that incomplete FTP multiline control responses are buffered without an upper bound.</p> <p>`FtpContext` stores incomplete control-channel data in `_partialResponse`:</p> <p>https://github.com/patrickjuchli/basic-ftp/blob/50827c73ca6c1d786c97276e47be8a33d0f2277d/src/FtpContext.ts#L63-L64</p> <p>Incoming control-channel data is handled in `_onControlSocketData`. The implementation concatenates the previous incomplete response with the new chunk, parses the entire accumulated string, and stores `parsed.rest` back into `_partialResponse`:</p> <p>https://github.com/patrickjuchli/basic-ftp/blob/50827c73ca6c1d786c97276e47be8a33d0f2277d/src/FtpContext.ts#L328-L340</p> <p>The relevant flo…</p> <p><strong>Affected:</strong> npm: basic-ftp</p> <p>## Summary</p> <p>`basic-ftp` is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses.</p> <p>A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into `FtpContext._partialResponse` and repeatedly reparses the accumulated buffer without enforcing a maximum control response size.</p> <p>As a result, an application using `basic-ftp` can remain stuck in `connect()` while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints.</p> <p>---</p> <p>## Details</p> <p>### Root cause</p> <p>The root cause is that incomplete FTP multiline control responses are buffered without an upper bound.</p> <p>`FtpContext` stores incomplete control-channel data in `_partialResponse`:</p> <p>https://github.com/patrickjuchli/basic-ftp/blob/50827c73ca6c1d786c97276e47be8a33d0f2277d/src/FtpContext.ts#L63-L64</p> <p>Incoming control-channel data is handled in `_onControlSocketData`. The implementation concatenates the previous incomplete response with the new chunk, parses the entire accumulated string, and stores `parsed.rest` back into `_partialResponse`:</p> <p>https://github.com/patrickjuchli/basic-ftp/blob/50827c73ca6c1d786c97276e47be8a33d0f2277d/src/FtpContext.ts#L328-L340</p> <p>The relevant flo…</p> https://cve.radiocsirt.org/vuln/ghsa-rpmf-866q-6p89 https://cve.radiocsirt.org/vuln/rhsa-2026:48693 <p>form-data: form-data: Form field override via CRLF injection hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution</p> <p>form-data: form-data: Form field override via CRLF injection hypershift: Konnectivity proxy-server accepts agent connections without validating client certificates golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution</p> https://cve.radiocsirt.org/vuln/rhsa-2026:48693 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44240 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-proxy-agents, Ubuntu:25.10: node-proxy-agents, Ubuntu:26.04:LTS: node-proxy-agents</p> <p>basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: node-proxy-agents, Ubuntu:25.10: node-proxy-agents, Ubuntu:26.04:LTS: node-proxy-agents</p> <p>basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-44240