CVE-2026-67607

LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

View on CVE.org
Published Jul 31, 2026 CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Description
LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.

Analysis

AI-generated

Technical impact

LightFTP 2.3.1 contains a residual race condition in the worker_thread_cleanup() function of ftpserv.c, caused by unsynchronized access to per‑connection state without the required mutex lock. Remote unauthenticated attackers can trigger the flaw by sending a data‑transfer command such as LIST immediately followed by ABOR, leading to daemon destabilization or crash and resulting in a denial of service. The 2.3.1 patch only narrowed the timing window with an extra re‑check and reordered cleanup, but never added the missing lock, so the underlying race remains.

Affected Systems

The vulnerable product is LightFTP, version 2.3.1, produced by hfiref0x.

Risk and Exploitability

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of widespread exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector is a remote connection over the network, where an attacker races a new session with a teardown process to cause the crash. No publicly confirmed exploit is known, but the high severity and availability impact warrant prompt remediation.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade LightFTP to a version that includes the race‑condition fix released by the vendor.
  • If an immediate upgrade is not feasible, limit access to the FTP service by allowing only trusted IP addresses through firewall rules.
  • Restart the LightFTP service periodically to clear any stalled worker threads and reduce the window for the race condition.

Generated by OpenCVE AI on August 4, 2026 at 11:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:2.3:a:hfiref0x:lightftp:*:*:*:*:*:*:*:*
Type Values Removed Values Added
Description LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability. LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.
Type Values Removed Values Added
First Time appeared Hfiref0x
Hfiref0x lightftp
Vendors & Products Hfiref0x
Hfiref0x lightftp
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.
Title LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup
Weaknesses CWE-367
References
Metrics cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.2, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}
Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Aug 14, 2026, 4:50 PM
Reserved
Jul 29, 2026, 9:07 PM

View source JSON

Updated
Jul 31, 2026, 4:17 PM

JSON

Status
Deferred
Published
Jul 31, 2026, 4:17 PM
Modified
Oct 23, 2026, 11:10 PM

View source JSON

No data.

Updated
Aug 4, 2026, 11:30 AM

JSON