{"schema_version":"2","view":"grouped","data":[{"id":61683,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/advisories/advisory%3Ac23a2c90-65ce-4138-b5e8-d51ea0a55ce8","group":{"id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","revision":1,"primary_event_id":60931,"change":"published","superseded_by":[],"changed":{"id":60931,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/events/60931"},"members":[{"id":60931,"cve_ids":["CVE-2026-102990"],"payload":{"kind":"advisory","title":"basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)","summary":"basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.","evidence":"cve:CVE-2026-102990","products":[{"name":{"value":"basic-ftp","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","structured":{"id":"CVE-2026-102990","aliases":["CVE-2026-102990"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.2,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"affected":[{"vendor":"patrickjuchli","product":"basic-ftp","versions":[{"status":"affected","version":"< 6.2.1"}]}],"modified":"2026-09-30T20:05:49.721Z","provider":"cve","references":["https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","https://github.com/patrickjuchli/basic-ftp/commit/d0d9e07c56e519587bb50532ac6eadbb0cb0cfe9","https://github.com/patrickjuchli/basic-ftp/releases/tag/v6.2.1"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-102990","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-30T20:05:43.038485Z"}}}],"references":[{"url":"https://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-c475-qrg2-pj4r","tags":["exploit"]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-30T20:05:49.721Z"}}],"cna":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-09-30T19:44:47.303Z"}}},"related_cves":[{"value":"CVE-2026-102990","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-102990","metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}],"products":[{"name":{"value":"basic-ftp","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"6.2.1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-c475-qrg2-pj4r","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveMetadata/cveId"}],"fix_available":false,"known_exploited":false,"publisher_severity":"high"},"revision":2,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-102990","advisory_id":"c23a2c90-65ce-4138-b5e8-d51ea0a55ce8","event_types":["advisory"],"published_at":"2026-10-25T18:53:33.445916+00:00","technologies":["basic-ftp","core-cve"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-30T19:44:47.303+00:00","detail_url":"/events/60931"}]}}],"next_after":61683,"next_before":61683}