CVE-2026-44240

basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.

• CWE-400
• CWE-770

• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44231RT is an open source, enterprise-grade issue and ticket trac…9.1
• CVE-2026-44232DSSRF is a Node.js library that provides a wide range of uti…8.7
• CVE-2026-44237FreePBX is an open source IP PBX. Prior to 17.0.8, the FreeP…8.1
• CVE-2026-44238FreePBX is an open source IP PBX. Prior to 16.0.50 and 17.0.…8.8
• CVE-2026-44239FreePBX is an open source IP PBX. Prior to 16.0.22 and 17.0.…8.8
• CVE-2026-4424A flaw was found in libarchive. This heap out-of-bounds read…7.5
• CVE-2026-44241Micronaut Framework is a JVM-based full stack Java framework…7.5
• CVE-2026-44242Micronaut Framework is a JVM-based full stack Java framework…3.7
• CVE-2026-44243GitPython is a python library used to interact with Git repo…7.1
• CVE-2026-44244GitPython is a python library used to interact with Git repo…7.8
• CVE-2026-44245Kyverno is a policy engine designed for cloud native platfor…6.1
• CVE-2026-44246nnU-Net is a semantic segmentation framework that automatica…7.2