{
  "threat_severity" : "Important",
  "public_date" : "2026-05-12T20:37:43Z",
  "bugzilla" : {
    "description" : "basic-ftp: basic-ftp: Client-side Denial of Service via unterminated multiline FTP responses",
    "id" : "2476813",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2476813"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-770",
  "details" : [ "basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basic-ftp is vulnerable to client-side denial of service when parsing FTP control-channel multiline responses. A malicious or compromised FTP server can send an unterminated multiline response during the initial FTP banner phase, before authentication. The client keeps appending attacker-controlled data into FtpContext._partialResponse and repeatedly reparses the accumulated buffer without enforcing a maximum control response size. As a result, an application using basic-ftp can remain stuck in connect() while memory and CPU usage grow under attacker-controlled input. This can lead to process-level denial of service, container OOM kills, worker restarts, queue backlog, or service degradation in applications that automatically connect to FTP endpoints. This vulnerability is fixed in 5.3.1.", "A flaw was found in basic-ftp, an FTP client for Node.js. A malicious or compromised FTP server can exploit this vulnerability by sending an unterminated multiline response during the initial FTP banner phase, before authentication. The client continuously appends attacker-controlled data and repeatedly reparses the accumulated buffer without enforcing a maximum size. This can lead to a client-side Denial of Service (DoS), causing the application to become unresponsive, consume excessive memory and CPU, and potentially result in process termination or service degradation." ],
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift AI 2.25",
    "release_date" : "2026-09-08T00:00:00Z",
    "advisory" : "RHSA-2026:65126",
    "cpe" : "cpe:/a:redhat:openshift_ai:2.25::el9",
    "package" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1787801527"
  }, {
    "product_name" : "Red Hat OpenShift AI 3.4",
    "release_date" : "2026-08-27T00:00:00Z",
    "advisory" : "RHSA-2026:60520",
    "cpe" : "cpe:/a:redhat:openshift_ai:3.4::el9",
    "package" : "rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1787121387"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.22",
    "release_date" : "2026-08-04T00:00:00Z",
    "advisory" : "RHSA-2026:48693",
    "cpe" : "cpe:/a:redhat:openshift:4.22::el9",
    "package" : "openshift4/ose-agent-installer-ui-rhel9:1785230147"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Developer Hub",
    "fix_state" : "Will not fix",
    "package_name" : "rhdh/rhdh-hub-rhel9",
    "cpe" : "cpe:/a:redhat:rhdh:1"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux AI (RHEL AI) 3",
    "fix_state" : "Affected",
    "package_name" : "rust",
    "cpe" : "cpe:/a:redhat:enterprise_linux_ai:3"
  }, {
    "product_name" : "Red Hat Hardened Images",
    "fix_state" : "Not affected",
    "package_name" : "rust",
    "cpe" : "cpe:/a:redhat:hummingbird:1"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift4/ose-console-rhel9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Not affected",
    "package_name" : "ansible-automation-platform/automation-portal",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  }, {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Not affected",
    "package_name" : "ansible-automation-platform/bootc-automation-portal-rhel9",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-44240\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44240\nhttps://github.com/patrickjuchli/basic-ftp/security/advisories/GHSA-rpmf-866q-6p89" ],
  "name" : "CVE-2026-44240",
  "mitigation" : {
    "value" : "To mitigate this issue, restrict applications using the `basic-ftp` client to connect only to trusted FTP servers. Implement firewall rules or network access controls to limit outbound connections from affected systems to known, legitimate FTP endpoints. This operational control reduces the exposure to malicious or compromised FTP servers that could exploit this vulnerability. A restart of the affected application may be required for changes to take effect.",
    "lang" : "en:us"
  },
  "csaw" : false
}