To report a vulnerability open a draft at https://github.com/patrickjuchli/basic-ftp/security/advisories. Thanks!
Security: patrickjuchli/basic-ftp
Security
SECURITY.md
-
Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking)GHSA-c475-qrg2-pj4r published
Aug 27, 2026 by patrickjuchliHigh -
basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response bufferingGHSA-rpmf-866q-6p89 published
Apr 28, 2026 by patrickjuchliHigh -
basic-ftp@5.2.2 vulnerable to denial of service via unbounded memory consumption in Client.list()GHSA-rp42-5vxx-qpwr published
Apr 15, 2026 by patrickjuchliHigh -
Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD CommandsGHSA-6v7q-wjvx-w8wg published
Apr 9, 2026 by patrickjuchliHigh -
FTP Command Injection via CRLF in basic-ftpGHSA-chqc-8p9q-pq6q published
Apr 8, 2026 by patrickjuchliHigh -
Path Traversal Vulnerability in basic-ftpGHSA-5rq4-664w-9x2c published
Feb 23, 2026 by patrickjuchliCritical
Learn more about advisories related to patrickjuchli/basic-ftp in the GitHub Advisory Database