{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "patrickjuchli basic-ftp: important CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/patrickjuchli--basic-ftp/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/patrickjuchli--basic-ftp/important.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102990/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102990/",
   "title": "CVE-2026-102990 · patrickjuchli basic-ftp · disclosed",
   "content_text": "basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list() can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE_LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fields when a long Unix-style line has a valid prefix but cannot satisfy the later size and date fields. parseList() selects a parser from the last nonblank line and then applies it to every line, so a normal final line can select the Unix parser while an earlier crafted line blocks the Node.js event loop and freezes the process. This issue is fixed in version 6.2.1.",
   "date_published": "2026-09-30T19:44:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102990/fixed/chainguard",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102990/",
   "title": "CVE-2026-102990 · patrickjuchli basic-ftp · fixed in Chainguard (code-server 4.140.0-r1 and 24 more)",
   "content_text": "Fixed versions: code-server 4.140.0-r1, gemini-cli 0.63.0-r2, kibana-9.2 9.2.8-r29, opensearch-dashboards-2-fips-security-dashboards-plugin 2.19.6-r12, opensearch-dashboards-2-security-dashboards-plugin 2.19.6-r23, opensearch-dashboards-3-fips-security-dashboards-plugin 3.8.0-r6, opensearch-dashboards-3-security-dashboards-plugin 3.8.0-r10, wazuh-dashboard-alerting-dashboards-plugin 4.14.8-r6, wazuh-dashboard-alerting-dashboards-plugin-fips 4.14.8-r4, wazuh-dashboard-anomaly-detection-dashboards-plugin 4.14.8-r6, wazuh-dashboard-anomaly-detection-dashboards-plugin-fips 4.14.8-r4, wazuh-dashboard-dashboards-maps 4.14.8-r6, wazuh-dashboard-dashboards-maps-fips 4.14.8-r4, wazuh-dashboard-dashboards-notifications 4.14.8-r6, wazuh-dashboard-dashboards-notifications-fips 4.14.8-r4, wazuh-dashboard-dashboards-reporting 4.14.8-r6, wazuh-dashboard-dashboards-reporting-fips 4.14.8-r4, wazuh-dashboard-dashboards-visualizations 4.14.8-r6, wazuh-dashboard-dashboards-visualizations-fips 4.14.8-r4, wazuh-dashboard-index-management-dashboards-plugin 4.14.8-r6, wazuh-dashboard-index-management-dashboards-plugin-fips 4.14.8-r4, wazuh-dashboard-plugins 4.14.8-r6, wazuh-dashboard-plugins-fips 4.14.8-r4, wazuh-dashboard-security-plugin 4.14.8-r6, wazuh-dashboard-security-plugin-fips 4.14.8-r4.",
   "date_published": "2026-09-30T19:44:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102990/fixed/debian-14",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102990/",
   "title": "CVE-2026-102990 · patrickjuchli basic-ftp · fixed in Debian 14 (node-proxy-agents 0~2025070717+~cs16.2.9-1)",
   "content_text": "Fixed versions: node-proxy-agents 0~2025070717+~cs16.2.9-1.",
   "date_published": "2026-09-30T19:44:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102990/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102990/",
   "title": "CVE-2026-102990 · patrickjuchli basic-ftp · fixed upstream (npm)",
   "content_text": "Fixed versions: basic-ftp 6.2.1.",
   "date_published": "2026-09-30T19:44:47Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-102990/fixed/wolfi",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-102990/",
   "title": "CVE-2026-102990 · patrickjuchli basic-ftp · fixed in Wolfi (code-server 4.140.0-r1 and 1 more)",
   "content_text": "Fixed versions: code-server 4.140.0-r1, opensearch-dashboards-3-security-dashboards-plugin 3.8.0-r10.",
   "date_published": "2026-09-30T19:44:47Z"
  }
 ]
}