CVE-2026-90870
Awaiting Analysis
Awaiting Analysis - Queue
Missing Session Release in WS_FTP Server Leads to Resource Exhaustion
Vulnerability report for CVE-2026-90870, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-29
Last updated on: 2026-10-29
Assigner: Progress Software Corporation
Description
Description
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Progress Software | WS_FTP Server | 0 |
| Progress Software | WS_FTP Server | 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-772 | The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed. |
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
