{"id":"CVE-2026-115339","kind":"vulnerability","aliases":["CVE-2026-115339"],"related":[],"title":"WS_FTP Server: missing resource limits let remote attackers crash it","description":"Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.","summary":"WS_FTP Server releases before 2025.0.5 on Windows do not enforce sufficient resource limits. An unauthenticated remote attacker can exhaust resources and cause a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"WS_FTP Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["file-transfer","vendor","windows","ws_ftp_server"],"not_affected_if":["non-windows","not-internet-exposed"],"how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Compare it against `2025.0.5`; anything lower is in the stated range.","fix":"- WS_FTP Server: move to `2025.0.5` or later.","status":"open","published_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","triaged_at":"2026-11-09T17:28:48+00:00","updated_at":"2026-11-09T17:28:48+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-09T17:28:48Z","model":"claude-haiku-5-5","output":{"fix":"- WS_FTP Server: move to `2025.0.5` or later.","reach":"internet","title":"WS_FTP Server: missing resource limits let remote attackers crash it","impact":"medium","summary":"WS_FTP Server releases before 2025.0.5 on Windows do not enforce sufficient resource limits. An unauthenticated remote attacker can exhaust resources and cause a denial of service.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ws_ftp_server","windows","file-transfer"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote attacker makes the file transfer server unavailable","analyst_note":"","how_to_check":"- Check the installed WS_FTP Server version in the admin console or on the server.\n- Compare it against `2025.0.5`; anything lower is in the stated range.","plain_action":"","product_name":"WS_FTP Server","needs_analyst":false,"not_affected_if":["non-windows","not-internet-exposed"],"who_is_affected":"Organisations running WS_FTP Server on Windows at a release before 2025.0.5 are exposed, and an unauthenticated attacker who can reach the service over the network can trigger the denial of service. Servers that are not exposed to untrusted networks, or that are not running WS_FTP Server, can skip this.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4523,"output_tokens":524,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-115339':13A,16A '-2026':12A,15A '2025.0.5':33B,67C 'allow':71C 'attack':9A,45B,75C 'caus':50B,77C 'could':70C 'crash':10A 'cve':11A,14A 'denial':52B,78C 'enforc':38B 'exhaust':47B 'file':21B 'file-transf':20B 'ftp':2A,18A,26B,29B,62C 'insuffici':55C 'let':7A 'limit':6A,41B,57C 'miss':4A 'prior':65C 'progress':59C 'releas':31B,64C 'remot':8A,44B,74C 'resourc':5A,40B,48B,56C 'server':3A,19A,27B,30B,63C 'servic':54B,80C 'softwar':60C 'suffici':39B 'transfer':22B 'unauthent':43B,73C 'vendor':23B 'window':24B,35B,69C 'ws':1A,17A,25B,28B,61C","nicknames":[],"mitigations":[],"who_affected":"Organisations running WS_FTP Server on Windows at a release before 2025.0.5 are exposed, and an unauthenticated attacker who can reach the service over the network can trigger the denial of service. Servers that are not exposed to untrusted networks, or that are not running WS_FTP Server, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["server","wsftpserver"],"ptokens":["ftp","server","ws"],"labels":["filetransfer","high","vendor","windows","wsftpserver"],"campaign_type":null,"search_a":"'-115339':13A,16A '-2026':12A,15A 'attack':9A 'crash':10A 'cve':11A,14A 'ftp':2A,18A 'let':7A 'limit':6A 'miss':4A 'remot':8A 'resourc':5A 'server':3A,19A 'ws':1A,17A","search_b":"'2025.0.5':33B 'attack':45B 'caus':50B 'denial':52B 'enforc':38B 'exhaust':47B 'file':21B 'file-transf':20B 'ftp':26B,29B 'limit':41B 'releas':31B 'remot':44B 'resourc':40B,48B 'server':27B,30B 'servic':54B 'suffici':39B 'transfer':22B 'unauthent':43B 'vendor':23B 'window':24B,35B 'ws':25B,28B","search_c":"'2025.0.5':67C 'allow':71C 'attack':75C 'caus':77C 'could':70C 'denial':78C 'ftp':62C 'insuffici':55C 'limit':57C 'prior':65C 'progress':59C 'releas':64C 'remot':74C 'resourc':56C 'server':63C 'servic':80C 'softwar':60C 'unauthent':73C 'window':69C 'ws':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115339","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115339","severity":null,"published_at":"2026-11-09T17:17:11+00:00","modified_at":"2026-11-09T17:17:11+00:00","first_seen_at":"2026-11-09T17:27:38+00:00","fetched_at":"2026-11-09T17:27:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}