{"id":"EUVD-2026-29840","revision":"02262b21f2764ede8e06e96814f13c75","records":[{"revision":"02262b21f2764ede8e06e96814f13c75","observedAt":"2026-10-28T06:06:37.069+00:00","statement":{"source":"euvd","id":"EUVD-2026-29840","aliases":["CVE-2026-44240","GHSA-rpmf-866q-6p89"],"title":"basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline …","description":"basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29840","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 12, 2026, 8:37:43 PM","dateUpdated":"May 14, 2026, 12:31:57 PM"},"relatedAdvisories":[{"id":"RHSA-2026:65126","title":"Red Hat Security Advisory: RHOAI 2.25.11 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61729","CVE-2025-67030","CVE-2026-4926","CVE-2026-6734","CVE-2026-9563","CVE-2026-9697","CVE-2026-12151","CVE-2026-12243","CVE-2026-13149","CVE-2026-15075","CVE-2026-15154","CVE-2026-15378","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-25681","CVE-2026-26996","CVE-2026-27136","CVE-2026-27904","CVE-2026-30922","CVE-2026-32283","CVE-2026-33231","CVE-2026-33810","CVE-2026-33811","CVE-2026-33814","CVE-2026-33870","CVE-2026-33871","CVE-2026-34445","CVE-2026-35536","CVE-2026-39821","CVE-2026-39829","CVE-2026-39835","CVE-2026-40171","CVE-2026-40192","CVE-2026-40895","CVE-2026-41178","CVE-2026-42027","CVE-2026-42215","CVE-2026-42284","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-42578","CVE-2026-42579","CVE-2026-42581","CVE-2026-42583","CVE-2026-42584","CVE-2026-42587","CVE-2026-44240","CVE-2026-44244","CVE-2026-44249","CVE-2026-44431","CVE-2026-44893","CVE-2026-45112","CVE-2026-45416","CVE-2026-45623","CVE-2026-45674","CVE-2026-45736","CVE-2026-45819","CVE-2026-47691","CVE-2026-48043","CVE-2026-48059","CVE-2026-48586","CVE-2026-48779","CVE-2026-49978","CVE-2026-50010","CVE-2026-50193","CVE-2026-53550","CVE-2026-54293","CVE-2026-54512","CVE-2026-55685","CVE-2026-55831","CVE-2026-55833","CVE-2026-55851","CVE-2026-56745","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59885","CVE-2026-59899","CVE-2026-66036","CVE-2026-66039","CVE-2026-67313","CVE-2026-67320","CVE-2026-67322","CVE-2026-67323","CVE-2026-67324","CVE-2026-67325","CVE-2026-68494","CVE-2026-69112","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73566","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73643"]},{"id":"RHSA-2026:73987","title":"Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-61726","CVE-2025-66471","CVE-2025-71408","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-5422","CVE-2026-6321","CVE-2026-6734","CVE-2026-9697","CVE-2026-11816","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-13149","CVE-2026-15154","CVE-2026-15378","CVE-2026-16221","CVE-2026-16745","CVE-2026-18951","CVE-2026-23490","CVE-2026-25681","CVE-2026-27136","CVE-2026-27489","CVE-2026-27893","CVE-2026-28356","CVE-2026-28500","CVE-2026-28684","CVE-2026-31230","CVE-2026-31958","CVE-2026-32274","CVE-2026-32286","CVE-2026-32597","CVE-2026-33186","CVE-2026-33231","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-33815","CVE-2026-33816","CVE-2026-34445","CVE-2026-34986","CVE-2026-34993","CVE-2026-35397","CVE-2026-35536","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39835","CVE-2026-40110","CVE-2026-41242","CVE-2026-42215","CVE-2026-42294","CVE-2026-42296","CVE-2026-42297","CVE-2026-42338","CVE-2026-42502","CVE-2026-42508","CVE-2026-44240","CVE-2026-44431","CVE-2026-44432","CVE-2026-44727","CVE-2026-44843","CVE-2026-45736","CVE-2026-46595","CVE-2026-48526","CVE-2026-48586","CVE-2026-48710","CVE-2026-48746","CVE-2026-48779","CVE-2026-49855","CVE-2026-53550","CVE-2026-54058","CVE-2026-54283","CVE-2026-55969","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-62384","CVE-2026-63310","CVE-2026-64834","CVE-2026-64835","CVE-2026-66036","CVE-2026-66037","CVE-2026-66038","CVE-2026-66040","CVE-2026-67322","CVE-2026-67323","CVE-2026-67325","CVE-2026-68770","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73627","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-84375","CVE-2026-84445"]},{"id":"RHSA-2026:60520","title":"Red Hat Security Advisory: RHOAI 3.4.4 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2025-66471","CVE-2025-66626","CVE-2025-71329","CVE-2025-71330","CVE-2026-0545","CVE-2026-2614","CVE-2026-5241","CVE-2026-5422","CVE-2026-6322","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-12243","CVE-2026-12481","CVE-2026-13149","CVE-2026-13311","CVE-2026-13676","CVE-2026-13717","CVE-2026-14450","CVE-2026-15154","CVE-2026-15218","CVE-2026-15378","CVE-2026-15467","CVE-2026-15581","CVE-2026-16745","CVE-2026-18608","CVE-2026-18611","CVE-2026-18617","CVE-2026-18620","CVE-2026-18621","CVE-2026-18948","CVE-2026-18951","CVE-2026-18982","CVE-2026-25681","CVE-2026-27136","CVE-2026-32280","CVE-2026-32283","CVE-2026-33079","CVE-2026-33245","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-35397","CVE-2026-39820","CVE-2026-39821","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39835","CVE-2026-40171","CVE-2026-41672","CVE-2026-41673","CVE-2026-41675","CVE-2026-42211","CVE-2026-42215","CVE-2026-42264","CVE-2026-42266","CVE-2026-42284","CVE-2026-42305","CVE-2026-42311","CVE-2026-42338","CVE-2026-42342","CVE-2026-42499","CVE-2026-42502","CVE-2026-42508","CVE-2026-42557","CVE-2026-44017","CVE-2026-44018","CVE-2026-44020","CVE-2026-44240","CVE-2026-44244","CVE-2026-44289","CVE-2026-44290","CVE-2026-44291","CVE-2026-44292","CVE-2026-44293","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44495","CVE-2026-44496","CVE-2026-44513","CVE-2026-44660","CVE-2026-44705","CVE-2026-44724","CVE-2026-44727","CVE-2026-44827","CVE-2026-44843","CVE-2026-45292","CVE-2026-45623","CVE-2026-45736","CVE-2026-45740","CVE-2026-45804","CVE-2026-46595","CVE-2026-46597","CVE-2026-46625","CVE-2026-47214","CVE-2026-48526","CVE-2026-48710","CVE-2026-48712","CVE-2026-48779","CVE-2026-48801","CVE-2026-49476","CVE-2026-49477","CVE-2026-49851","CVE-2026-49978","CVE-2026-50193","CVE-2026-53550","CVE-2026-54058","CVE-2026-54060","CVE-2026-54283","CVE-2026-54293","CVE-2026-55379","CVE-2026-55380","CVE-2026-55685","CVE-2026-56121","CVE-2026-56208","CVE-2026-56209","CVE-2026-56210","CVE-2026-56211","CVE-2026-58049","CVE-2026-59197","CVE-2026-59199","CVE-2026-59200","CVE-2026-59204","CVE-2026-59205","CVE-2026-59869","CVE-2026-59873","CVE-2026-59874","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-64835","CVE-2026-64849","CVE-2026-69152","CVE-2026-69192","CVE-2026-69243","CVE-2026-69244"]},{"id":"RHSA-2026:48693","title":"Red Hat Security Advisory: OpenShift Container Platform 4.22.8 bug fix and security update","vulnerabilityIds":["CVE-2026-12143","CVE-2026-16242","CVE-2026-39829","CVE-2026-44240","CVE-2026-45736","CVE-2026-46597","CVE-2026-49978"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29840","identifiers":["EUVD-2026-29840","CVE-2026-44240","GHSA-rpmf-866q-6p89"]},"retained":false,"historicalAffected":[]}],"coverage":[]}