The basic-ftp library contains a critical resource consumption vulnerability that allows an unauthenticated remote FTP server to crash the client application via memory exhaustion.

This is a resource consumption flaw (CWE-400) occurring within the Client.list() function. An unauthenticated remote FTP server can trigger the vulnerability by providing an maliciously crafted or infinite directory listing response, causing the client process to consume memory until failure.

Successful exploitation of this vulnerability leads to a denial of service, which can cause significant operational disruption for applications relying on the basic-ftp client for data transfers. With a CVSS score of 7.5, this issue represents a high risk to availability, as it allows external, untrusted sources to force service instability.

Immediate Action: Update the basic-ftp package to version 5.3.0 or later to implement necessary memory limits during directory listing operations.

Proactive Monitoring: Monitor server memory usage and process logs for unexpected spikes or crashes occurring during FTP client-server interactions.

Compensating Controls: If immediate patching is not possible, implement stricter validation on connections to external FTP servers and utilize resource quotas at the container or process level to mitigate the impact of memory exhaustion.

Public Exploit Available: No (exploit_available: false)

Given the ease of exploitation and the potential for service disruption, administrators should prioritize updating to version 5.3.0. This patch effectively remediates the resource consumption flaw by introducing necessary limits, thereby protecting the application from memory-based denial of service attacks originating from compromised or malicious FTP servers.