CVE-2026-102990
HighAdvisory
Published 30 Sept 2026In the index since 2 Oct 2026
- Severity
- High
- worst across findings
- CVSS
- 8.2
- base score, highest
- EPSS
- 0.004
- 29th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 72
- of 18,026 indexed, latest versions
- Container images
- 69
- deployed by those charts
- Fix available
- 1 of 2
- affected packages
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)
Carried by container images the latest versions of 72 of 18,026 indexed charts deploy, on 69 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| basic-ftpnpm | 5.0.3, 5.0.4, 5.0.5, 5.1.0+4 more | 6.2.1 | 67 |
| node-proxy-agentsdeb | 7.1.0~0~2023071921-5, 7.1.1~0~2024040606-6+deb13u1 | no fix listed | 3 |
Charts affected
72 by stars
Container images carrying it
69 by charts deploying them
A fixed version is listed for 1 of the 2 affected packages.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| decisionrules/ | bb3a93224b5a | basic-ftp | 6.2.1 | 4 |
| joplin/ | 3f7b852959aa | basic-ftp | 6.2.1 | 3 |
| opensearchproject/ | 4bdb8ded547c | basic-ftp | 6.2.1 | 3 |
| etherpad/ | 98d395769b3b | basic-ftp | 6.2.1 | 2 |
| freikin/ | e58334ca5697 | node-proxy-agents | no fix listed | 2 |
| ghcr.io/ | 7e2ef5261764 | basic-ftp | 6.2.1 | 2 |
| aktosecurity/ | 853e37321e6e | basic-ftp | 6.2.1 | 1 |
| apecloud/ | b3ae37840ace | basic-ftp | 6.2.1 | 1 |
| budibase/ | 44fe6feab985 | basic-ftp | 6.2.1 | 1 |
| budibase/ | de5e2e560ce8 | basic-ftp | 6.2.1 | 1 |
| camptocamp/ | ae874f70cc16 | basic-ftp node-proxy-agents | 6.2.1 no fix listed | 1 |
| chainsafe/ | 7b9fe4aa8073 | basic-ftp | 6.2.1 | 1 |
| codetogether/ | 4348c8a38752 | basic-ftp | 6.2.1 | 1 |
| dacinfomotion/ | 68fa393b472c | basic-ftp | 6.2.1 | 1 |
| directus/ | 9c8470ea465c | basic-ftp | 6.2.1 | 1 |
| directus/ | e3c8bb975350 | basic-ftp | 6.2.1 | 1 |
| diygod/ | 7a6312cac0d5 | basic-ftp | 6.2.1 | 1 |
| diygod/ | d5fd850a359a | basic-ftp | 6.2.1 | 1 |
| growthbook/ | 67b7cd7d12a1 | basic-ftp | 6.2.1 | 1 |
| growthbook/ | c8a124f55dca | basic-ftp | 6.2.1 | 1 |
| joplin/ | 52af57880c0e | basic-ftp | 6.2.1 | 1 |
| jupyterhub/ | 3974ba945e65 | node-proxy-agents | no fix listed | 1 |
| langgenius/ | a2a294743634 | basic-ftp | 6.2.1 | 1 |
| langgenius/ | c306ac577912 | basic-ftp | 6.2.1 | 1 |
| langgenius/ | d64914ff0d6d | basic-ftp | 6.2.1 | 1 |
| library/ | 0172f1c538e7 | basic-ftp | 6.2.1 | 1 |
| litlyx/ | e64ff2d52385 | basic-ftp | 6.2.1 | 1 |
| moonrailgun/ | b528c8f8fcc4 | basic-ftp | 6.2.1 | 1 |
| nocodb/ | 4ccfc5114506 | basic-ftp | 6.2.1 | 1 |
| nocodb/ | d9516f0bf546 | basic-ftp | 6.2.1 | 1 |
| opensearchproject/ | 0ecd8444add2 | basic-ftp | 6.2.1 | 1 |
| phpdockerio/ | ea8354b42600 | basic-ftp | 6.2.1 | 1 |
| sigp/ | 2c219b04758e | basic-ftp | 6.2.1 | 1 |
| speckle/ | 092384dba45d | basic-ftp | 6.2.1 | 1 |
| speckle/ | 1f897ca906ea | basic-ftp | 6.2.1 | 1 |
| speckle/ | 52cad5e3293e | basic-ftp | 6.2.1 | 1 |
| speckle/ | 6dee853ba74a | basic-ftp | 6.2.1 | 1 |
| speckle/ | 787adcb20a3a | basic-ftp | 6.2.1 | 1 |
| speckle/ | 8f3c1ea153ba | basic-ftp | 6.2.1 | 1 |
| speckle/ | c102b087481a | basic-ftp | 6.2.1 | 1 |
| speckle/ | d3da0a84de98 | basic-ftp | 6.2.1 | 1 |
| treskon/ | e7970783bc8d | basic-ftp | 6.2.1 | 1 |
| veecode/ | 881f936ff4a3 | basic-ftp | 6.2.1 | 1 |
| wazuh/ | 0c58e7b47bb6 | basic-ftp | 6.2.1 | 1 |
| wazuh/ | 91c8d793746f | basic-ftp | 6.2.1 | 1 |
| wazuh/ | 91e4f0a7feed | basic-ftp | 6.2.1 | 1 |
| yuzutech/ | 444805c4b917 | basic-ftp | 6.2.1 | 1 |
| yuzutech/ | b810edbf9c62 | basic-ftp | 6.2.1 | 1 |
| yuzutech/ | 57917319ea70 | basic-ftp | 6.2.1 | 1 |
| yuzutech/ | 963b4acfde6e | basic-ftp | 6.2.1 | 1 |