CVE-2026-90870 in WS_FTP Server
Summary
by MITRE • 10/29/2026
A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could lead to server resource exhaustion and service degradation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability identified involves a critical resource management flaw within the Ad Hoc Transfer component of Progress Software WS_FTP Server, specifically affecting versions prior to 2024.0.7 and 2025.0.4 on Windows operating systems. This issue is classified as CWE-401, which denotes a missing release of memory or other resources after their effective use. In the context of enterprise file transfer applications like WS_FTP Server, backend receiver sessions are essential for managing active connections that facilitate data ingestion from remote clients. When these sessions are initiated but not properly terminated and released upon completion or termination, they remain allocated in system memory as zombie processes or orphaned objects. This accumulation occurs because the application fails to execute the necessary cleanup routines that would otherwise deallocate the associated resources and close underlying network sockets.
The operational impact of this resource leak is significant for organizations relying on WS_FTP Server for high-volume or continuous file transfer operations. As more Ad Hoc Transfer sessions are established without proper release, the server gradually consumes available memory and handles until system limits are reached. This leads to a state of service degradation where legitimate users experience slow response times, failed connection attempts, or complete unavailability of the FTP services. In severe cases, this can result in a Denial of Service condition, effectively halting business-critical data exchanges. The vulnerability is particularly dangerous because it does not require complex exploitation techniques; simply initiating and closing numerous Ad Hoc Transfer sessions over time will steadily degrade server performance, making it an attractive target for automated denial-of-service attacks or accidental exhaustion due to high traffic volumes.
From a threat intelligence perspective, this flaw aligns with ATT&CK technique T1499, Endpoint Denial of Service, specifically under the sub-technique of resource exhaustion via application logic flaws. Attackers can leverage this weakness by scripting automated tools that rapidly open and close Ad Hoc Transfer sessions to exhaust server resources without needing valid credentials or complex payload delivery mechanisms. The lack of proper session lifecycle management indicates a gap in the software's defensive coding practices, allowing for sustained pressure on system stability. This type of vulnerability is often overlooked during standard penetration testing unless specific resource monitoring tools are employed to detect gradual memory leaks over extended periods.
To mitigate this risk, organizations must immediately upgrade WS_FTP Server to version 2024.0.7 or later, where the vendor has implemented fixes for the session release logic in the Ad Hoc Transfer component. Until an upgrade is feasible, administrators should implement strict rate limiting on incoming connections and monitor server resource usage metrics such as memory consumption and active handle counts. Configuring automated alerts for abnormal spikes in connection activity can help detect potential exploitation attempts early. Additionally, reviewing application logs for frequent session creation without corresponding termination events may provide visibility into the extent of the leak within specific environments. Regular patching cycles are essential to address such resource management deficiencies before they escalate into critical service outages that disrupt organizational operations.