The vulnerability in patrickjuchli's basic-ftp (CVE-2026-41324) is an uncontrolled resource consumption flaw (CWE-400) affecting versions before 5.3.0. When the FTP client processes directory listings from a remote server, a malicious or compromised server can send an extremely large or infinite listing response. This causes the client to consume memory without bounds, potentially leading to denial of service by crashing or destabilizing the client application. The issue is fixed in version 5.3.0.

An attacker controlling or compromising an FTP server can exploit this vulnerability to cause denial of service on clients using vulnerable versions of basic-ftp by sending large or never-ending directory listings. This results in high memory consumption on the client side, leading to instability or crashes. There is no impact on confidentiality or integrity reported.

Upgrade basic-ftp to version 5.3.0 or later, where this vulnerability is fixed. Since no official patch advisory is provided beyond this version information, users should verify they are running 5.3.0 or newer to mitigate the risk. Patch status is not explicitly confirmed by a vendor advisory but the description states version 5.3.0 fixes the issue.