A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server allows an attacker to trigger uncontrolled resource consumption by creating many transfer requests. The resulting exhaustion of server resources can degrade service availability. The vulnerability is classified under CWE‑400 (Uncontrolled Resource Consumption) and CWE‑772 (Unreleased Resource). Although the description indicates unauthenticated access to the Ad Hoc Transfer endpoint, the exact authentication requirements are not detailed, so the likely attack vector is unauthenticated network traffic to that endpoint.

Progress Software WS_FTP Server on Windows, versions prior to 2024.0.7 and 2025.0.4, where the Ad Hoc Transfer component fails to release backend receiver sessions.

The CVSS score of 5.3 places this vulnerability at medium severity, and the EPSS score is not available, indicating the exploitation probability is not quantified at this time. The CVE is not listed in the CISA KEV catalog, suggesting no confirmed public exploits. Nevertheless, because the flaw permits resource exhaustion via unauthenticated access to the Ad Hoc Transfer endpoint, active monitoring and the available workaround are prudent to mitigate potential service degradation.