CVE-2026-102990

A flaw was found in basic-ftp. A malicious or compromised FTP server can cause a Denial of Service (DoS) by returning specially crafted Unix directory listings to the client. Inefficient regular expression processing during directory parsing leads to excessive CPU consumption, blocking the application event loop and causing the process to become unresponsive.

This vulnerability is rated as Important because connecting to an untrusted or hostile remote FTP endpoint allows unauthenticated actors to trigger catastrophic CPU exhaustion, halting application responsiveness. In Red Hat solutions embedding this client library, parsing manipulated directory contents monopolizes the single-threaded Node.js event engine, causing an outright denial of service across all concurrent operations. Risk is confined to workflows where the client actively queries and lists directories on untrusted external file transfer services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.