Skip to content
CVE PROGRAM SOURCE RECORD6.9 Medium

CVE-2026-102722

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious serv

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

In the IPv4 PASV path, the FTP Client accepts whatever address was sent in the server's `227` reply. Validation only covers the parse and the non-zero values, thus a malicious server can name any address and direct the Client there.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation NetX Duo

Default version status: unaffected

  • 0 to ≤ 6.5.1.202602affected

References