StackRadar

CVE-2026-102990

High

Advisory

Published 30 Sept 2026In the index since 2 Oct 2026
Severity
High
worst across findings
CVSS
8.2
base score, highest
EPSS
0.004
29th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
72
of 18,026 indexed, latest versions
Container images
69
deployed by those charts
Fix available
1 of 2
affected packages

basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)

Carried by container images the latest versions of 72 of 18,026 indexed charts deploy, on 69 images.

Affected packageAffected versionsFixed inImages
basic-ftpnpm5.0.3, 5.0.4, 5.0.5, 5.1.0+4 more6.2.167
node-proxy-agentsdeb7.1.0~0~2023071921-5, 7.1.1~0~2024040606-6+deb13u1no fix listed3
OSV records
DEBIAN-CVE-2026-102990GHSA-c475-qrg2-pj4rUBUNTU-CVE-2026-102990

Charts affected

72 by stars
ChartLatestAffected imagesRadar Score
web-checkrm3lVerified publisher0.1.01 of 1See more

web-check rm3l 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/lissy93/web-check:latest7e2ef5261764
basic-ftp@5.3.1
6.2.1

Open the chart page →

8,454
joplinrubxkubeVerified publisher1.3.11 of 2See more

joplin rubxkube 1.3.1

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
joplin/server:3.0-beta52af57880c0e
basic-ftp@5.0.3
6.2.1

Open the chart page →

8,151
rybbitrybbit-helm1.3.21 of 7See more

rybbit rybbit-helm 1.3.2

1 of the 7 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
basic-ftp@5.1.0
6.2.1

Open the chart page →

8,250
rsshubsb-helm-charts0.3.01 of 1See more

rsshub sb-helm-charts 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
diygod/rsshub:2025-11-097a6312cac0d5
basic-ftp@5.0.5
6.2.1

Open the chart page →

5,315
etherpadschoenwald0.4.11 of 1See more

etherpad schoenwald 0.4.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
etherpad/etherpad:3.3.698d395769b3b
basic-ftp@5.3.1
6.2.1

Open the chart page →

309
joplin-serverschoenwald1.0.31 of 1See more

joplin-server schoenwald 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
joplin/server:3.7.23f7b852959aa
basic-ftp@5.3.1
6.2.1

Open the chart page →

2,964
speckle-preview-service-branch-testing6speckleVerified publisher2.23.14-branch.testing6.334655-b4e04ee1 of 1See more

speckle-preview-service-branch-testing6 speckle 2.23.14-branch.testing6.334655-b4e04ee

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.23.14-branch.testing6.334655-b4e04ee6dee853ba74a
basic-ftp@5.0.5
6.2.1

Open the chart page →

6,554
speckle-server-branch-hotfix-2.19.1speckleVerified publisher2.19.2-branch.hotfix-2.19.1.124125-665e7e11 of 5See more

speckle-server-branch-hotfix-2.19.1 speckle 2.19.2-branch.hotfix-2.19.1.124125-665e7e1

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.19.2-branch.hotfix-2.19.1.124125-665e7e1c102b087481a
basic-ftp@5.0.5
6.2.1

Open the chart page →

18,109
speckle-server-branch-hotfix-2.20.2speckleVerified publisher2.20.3-branch.hotfix-2.20.2.149555-37ea0cb1 of 5See more

speckle-server-branch-hotfix-2.20.2 speckle 2.20.3-branch.hotfix-2.20.2.149555-37ea0cb

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.3-branch.hotfix-2.20.2.149555-37ea0cbd3da0a84de98
basic-ftp@5.0.5
6.2.1

Open the chart page →

18,193
speckle-server-branch-testing1speckleVerified publisher2.20.6-branch.testing1.154030-9b091141 of 5See more

speckle-server-branch-testing1 speckle 2.20.6-branch.testing1.154030-9b09114

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.6-branch.testing1.154030-9b091148f3c1ea153ba
basic-ftp@5.0.5
6.2.1

Open the chart page →

18,193
speckle-server-branch-testing4speckleVerified publisher2.20.2-branch.testing4.134160-9fad4b21 of 5See more

speckle-server-branch-testing4 speckle 2.20.2-branch.testing4.134160-9fad4b2

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.20.2-branch.testing4.134160-9fad4b21f897ca906ea
basic-ftp@5.0.5
6.2.1

Open the chart page →

17,762
speckle-server-branch-testing5speckleVerified publisher2.21.3-branch.testing5.219631-2153bef1 of 5See more

speckle-server-branch-testing5 speckle 2.21.3-branch.testing5.219631-2153bef

1 of the 5 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.21.3-branch.testing5.219631-2153bef52cad5e3293e
basic-ftp@5.0.5
6.2.1

Open the chart page →

17,437
speckle-server-branch-testing6speckleVerified publisher2.25.10-branch.testing6.645-b125c1e1 of 4See more

speckle-server-branch-testing6 speckle 2.25.10-branch.testing6.645-b125c1e

1 of the 4 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
speckle/speckle-preview-service:2.25.10-branch.testing6.645-b125c1e787adcb20a3a
basic-ftp@5.0.5
6.2.1

Open the chart page →

12,574
lodestar-validatorstakewise1.2.01 of 1See more

lodestar-validator stakewise 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
chainsafe/lodestar:v1.27.07b9fe4aa8073
basic-ftp@5.0.3
6.2.1

Open the chart page →

4,942
joplintobiassackmann0.1.71 of 2See more

joplin tobiassackmann 0.1.7

1 of the 2 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
joplin/server:latest3f7b852959aa
basic-ftp@5.3.1
6.2.1

Open the chart page →

6,295
devportalveecode-platform-nextVerified publisher1.0.11 of 1See more

devportal veecode-platform-next 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
veecode/devportaldigest-pinned881f936ff4a3
basic-ftp@5.3.1
6.2.1

Open the chart page →

1,562
browserlessvictorlane0.2.01 of 1See more

browserless victorlane 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
basic-ftp@5.2.0
6.2.1

Open the chart page →

5,214
sirenwateim1.0.21 of 1See more

siren wateim 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
sigp/siren:v3.0.42c219b04758e
basic-ftp@5.0.5
6.2.1

Open the chart page →

6,436
wazuhwazuh-helm-eksVerified publisher1.2.101 of 6See more

wazuh wazuh-helm-eks 1.2.10

1 of the 6 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
wazuh/wazuh-dashboard:4.14.491c8d793746f
basic-ftp@5.0.5
6.2.1

Open the chart page →

7,239
opensearch-dashboardswener3.9.01 of 1See more

opensearch-dashboards wener 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
basic-ftp@5.3.1
6.2.1

Open the chart page →

312
opensearch-dashboardswenerme3.9.01 of 1See more

opensearch-dashboards wenerme 3.9.0

1 of the 1 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:3.9.04bdb8ded547c
basic-ftp@5.3.1
6.2.1

Open the chart page →

312
ygdrassil-monitoringygdrassilVerified publisher0.4.01 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

1 of the 10 container images this version deploys carry CVE-2026-102990.

Container imageDigestPackageFixed in
opensearchproject/opensearch-dashboards:2.18.00ecd8444add2
basic-ftp@5.0.5
6.2.1

Open the chart page →

12,360

Container images carrying it

69 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/adnoctem/lhci:1.0.119553e4b4033
basic-ftp@5.3.1
6.2.1
1
ghcr.io/akash-network/console-api:2.64.0ba359097329d
basic-ftp@5.0.5
6.2.1
1
ghcr.io/akash-network/provider-proxy:1.4.353f533d7c6f8
basic-ftp@5.0.5
6.2.1
1
ghcr.io/backstage/backstage:lateste2a48bb6ab55
basic-ftp@5.3.1
6.2.1
1
ghcr.io/browserless/chromium:v2.43.0853e6f105b51
basic-ftp@5.2.0
6.2.1
1
ghcr.io/cosmo-workspace/dev-code-server:v0.0.316fda01ae58a
basic-ftp@5.0.5
6.2.1
1
ghcr.io/flanksource/facet:0.1.73a0323f4283e5
basic-ftp@5.3.1
6.2.1
1
ghcr.io/formancehq/console-v3:v1.16.0c99e8ef2c545
basic-ftp@5.0.5
6.2.1
1
ghcr.io/formancehq/portal:v1.16.06efef5d19d56
basic-ftp@5.0.5
6.2.1
1
ghcr.io/manzil-infinity180/backend-dumpstore:226f28ca3efa6d3691044813cd09085e28d4a7b496c90cf82fdd
basic-ftp@5.0.5
6.2.1
1
ghcr.io/rybbit-io/rybbit-backend:lateste0d1b397e33c
basic-ftp@5.1.0
6.2.1
1
ghcr.io/wiremind/grafana-pdf-exporter:v1.7dbaa8527bf4c
basic-ftp@5.0.3
6.2.1
1
public.ecr.aws/g4a0y2u8/unifie-store:staging-19925a2057fabc948
basic-ftp@5.0.5
6.2.1
1
public.ecr.aws/jtekt-corporation/shinsei-manager:v2.8.15cd62142d6ed
basic-ftp@5.0.4
6.2.1
1
quay.io/rhdh/rhdh-hub-rhel9:latest4f8c0f8a8ee0
basic-ftp@5.3.0
6.2.1
1
quay.io/soketi/soketi:1.6-16-debian713223456cf1
basic-ftp@5.0.3
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend:1.0.31c7afac3446d6
basic-ftp@5.2.0
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer:1.0.310e3cd8c7776d
basic-ftp@5.0.5
6.2.1
1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-user:1.0.31d8a9cd4e1ae3
basic-ftp@5.2.0
6.2.1
1

syft 1.42.1 · advisories as of 6 Oct 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.