basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-102990 · CVE overview and exploitation status

EUVD-2026-90360

GHSA-c475-qrg2-pj4r

cve-program · CVE-2026-102990

• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
• https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1

euvd · EUVD-2026-90360

• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
• https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1

nvd · CVE-2026-102990

• https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1
• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r

osv · GHSA-c475-qrg2-pj4r

• https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r
• https://nvd.nist.gov/vuln/detail/CVE-2026-102990
• https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9
• https://github.com/patrickjuchli/basic-ftp
• https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1

No related changes are available here.