https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:09:12 +0000 https://db.gcve.eu/vuln/ghsa-rp42-5vxx-qpwr <p><strong>Affected:</strong> npm: basic-ftp</p> <p>### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.</p> <p>### Details The issue is in the package&#39;s default directory listing flow.</p> <p>`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:</p> <p>File: `dist/Client.js:516-527`</p> <p>```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: &#34;&#34;, type: &#34;list&#34; }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```</p> <p>The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:</p> <p>File: `dist/StringWriter.js:5-20`</p> <p>```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error(&#34;StringWriter expects chunks…</p> <p><strong>Affected:</strong> npm: basic-ftp</p> <p>### Summary `basic-ftp@5.2.2` is vulnerable to denial of service through unbounded memory growth while processing directory listings from a remote FTP server. A malicious or compromised server can send an extremely large or never-ending listing response to `Client.list()`, causing the client process to consume memory until it becomes unstable or crashes.</p> <p>### Details The issue is in the package&#39;s default directory listing flow.</p> <p>`Client.list()` reaches `dist/Client.js`, where the full listing response is downloaded into a `StringWriter` before parsing:</p> <p>File: `dist/Client.js:516-527`</p> <p>```js async _requestListWithCommand(command) { const buffer = new StringWriter_1.StringWriter(); await (0, transfer_1.downloadTo)(buffer, { ftp: this.ftp, tracker: this._progressTracker, command, remotePath: &#34;&#34;, type: &#34;list&#34; }); const text = buffer.getText(this.ftp.encoding); this.ftp.log(text); return this.parseList(text); } ```</p> <p>The vulnerable sink is `StringWriter`, which grows an in-memory `Buffer` with no limit:</p> <p>File: `dist/StringWriter.js:5-20`</p> <p>```js class StringWriter extends stream_1.Writable { constructor() { super(...arguments); this.buf = Buffer.alloc(0); } _write(chunk, _, callback) { if (chunk instanceof Buffer) { this.buf = Buffer.concat([this.buf, chunk]); callback(null); } else { callback(new Error(&#34;StringWriter expects chunks…</p> https://db.gcve.eu/vuln/ghsa-rp42-5vxx-qpwr