LightFTP 2.3.1 contains a residual race condition in the worker_thread_cleanup() function of ftpserv.c, caused by unsynchronized access to per‑connection state without the required mutex lock. Remote unauthenticated attackers can trigger the flaw by sending a data‑transfer command such as LIST immediately followed by ABOR, leading to daemon destabilization or crash and resulting in a denial of service. The 2.3.1 patch only narrowed the timing window with an extra re‑check and reordered cleanup, but never added the missing lock, so the underlying race remains.

The vulnerable product is LightFTP, version 2.3.1, produced by hfiref0x.

The vulnerability has a CVSS score of 8.2, indicating high severity. The EPSS score is below 1 %, suggesting a low probability of widespread exploitation, and it is not listed in CISA’s KEV catalog. The likely attack vector is a remote connection over the network, where an attacker races a new session with a teardown process to cause the crash. No publicly confirmed exploit is known, but the high severity and availability impact warrant prompt remediation.