{
  "@id": "urn:uuid:7acb185e-88a6-4dc1-9dc2-276b722d5fdd",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T18:57:09.927745+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-10-01T14:50:16.510209+00:00",
      "status_notes": "Vulnerability CVE-2026-102990 affects version 6.0.1 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-102990"
      },
      "action_statement": "Vulnerability CVE-2026-102990 affects version 6.0.1 of basic-ftp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-14T18:57:09.927745+00:00",
      "status_notes": "Vulnerability CVE-2026-126345 affects version 6.0.1 of basic-ftp, and is fixed in 6.0.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-126345"
      },
      "action_statement": "Vulnerability CVE-2026-126345 affects version 6.0.1 of basic-ftp, and is fixed in 6.0.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-12T22:50:34.840878+00:00",
      "status_notes": "Vulnerability CVE-2026-126346 affects version 6.0.1 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-126346"
      },
      "action_statement": "Vulnerability CVE-2026-126346 affects version 6.0.1 of basic-ftp."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-10-30T06:32:00.079238+00:00",
      "status_notes": "Vulnerability CVE-2026-27699 affects version 6.0.1 of basic-ftp.",
      "vulnerability": {
        "name": "CVE-2026-27699"
      },
      "action_statement": "Vulnerability CVE-2026-27699 affects version 6.0.1 of basic-ftp."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability CVE-2026-39983 does not affect version 6.0.1 of basic-ftp. not_affected \u2014 The target (basic-ftp 6.0.1) already contains the upstream CRLF-injection fix. FtpContext.send() throws on any command containing CR, LF or NUL before it writes to the control socket. This is upstream commit 20327d3, authored by Patrick Juchli and an ancestor of HEAD.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39983"
      },
      "impact_statement": "not_affected \u2014 The target (basic-ftp 6.0.1) already contains the upstream CRLF-injection fix. FtpContext.send() throws on any command containing CR, LF or NUL before it writes to the control socket. This is upstream commit 20327d3, authored by Patrick Juchli and an ancestor of HEAD."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability CVE-2026-41324 does not affect version 6.0.1 of basic-ftp. not_affected \u2014 Not affected. The upstream fix for CVE-2026-41324 is already in the target (basic-ftp 6.0.1). StringWriter enforces a maxByteLength cap, and Client.list() passes it options.maxListingBytes (default 40 MiB), aborting the transfer when exceeded. The fix commits were authored upstream by Patrick Juchli and are ancestors of HEAD; HEAD has no TuxCare-domain commits.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41324"
      },
      "impact_statement": "not_affected \u2014 Not affected. The upstream fix for CVE-2026-41324 is already in the target (basic-ftp 6.0.1). StringWriter enforces a maxByteLength cap, and Client.list() passes it options.maxListingBytes (default 40 MiB), aborting the transfer when exceeded. The fix commits were authored upstream by Patrick Juchli and are ancestors of HEAD; HEAD has no TuxCare-domain commits."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:28:00.045761+00:00",
      "status_notes": "Vulnerability CVE-2026-44240 does not affect version 6.0.1 of basic-ftp. not_affected \u2014 Target basic-ftp 6.0.1 already contains the upstream fix (commit 980371b, \"Guard against unbounded control response\"). FtpContext._onControlSocketData rejects and closes the connection when the buffered partial response plus the new chunk exceeds 64 KiB, so the unterminated-multiline DoS cannot occur. The fix was authored upstream by Patrick Juchli and shipped in the release before the only Tux...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44240"
      },
      "impact_statement": "not_affected \u2014 Target basic-ftp 6.0.1 already contains the upstream fix (commit 980371b, \"Guard against unbounded control response\"). FtpContext._onControlSocketData rejects and closes the connection when the buffered partial response plus the new chunk exceeds 64 KiB, so the unterminated-multiline DoS cannot occur. The fix was authored upstream by Patrick Juchli and shipped in the release before the only Tux..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/basic-ftp@6.0.1",
          "identifiers": {
            "purl": "pkg:npm/basic-ftp@6.0.1"
          }
        }
      ],
      "timestamp": "2026-11-13T21:29:00.039512+00:00",
      "status_notes": "Vulnerability GHSA-6v7q-wjvx-w8wg does not affect version 6.0.1 of basic-ftp. not_affected \u2014 The target already contains the upstream fix 20327d3 (centralised control-character rejection in FtpContext.send()). Every command, including USER/PASS in login() and MKD in _openDir(), is checked before it is written to the socket, so CRLF injection is blocked. The fix is upstream-authored and shipped in the upstream release.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "GHSA-6v7q-wjvx-w8wg"
      },
      "impact_statement": "not_affected \u2014 The target already contains the upstream fix 20327d3 (centralised control-character rejection in FtpContext.send()). Every command, including USER/PASS in login() and MKD in _openDir(), is checked before it is written to the socket, so CRLF injection is blocked. The fix is upstream-authored and shipped in the upstream release."
    }
  ]
}