CVE-2026-67607

Received Received - Intake

Race Condition in LightFTP Server Causes Denial of Service

Publication date: 2026-07-31

Last updated on: 2026-08-03

Assigner: VulnCheck

Description

LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-31

Last Modified

2026-08-03

Generated

2026-08-20

AI Q&A

2026-07-31

EPSS Evaluated

2026-08-19

NVD

CVE-2026-67607

EUVD

EUVD-2026-51558

Affected Vendors & Products

Vendor	Product	Version / Range
lightftp	lightftp	2.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

LightFTP 2.3.1 has a race condition flaw where remote attackers can crash the server. The issue occurs when a new connection reuses the FTP context while an ABRT cleanup is in progress. Attackers exploit an unprotected check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock, causing pthread_join() to use an invalid thread ID and crash the server.

Detection Guidance

Detecting this vulnerability requires monitoring for race conditions in LightFTP 2.3.1. Check for server crashes during concurrent connections or cleanup operations. Use network monitoring tools to observe FTP session behavior and thread management. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows remote attackers to cause a denial of service by crashing the LightFTP server. If exploited, it could disrupt file transfer services, leading to downtime and potential loss of access to critical data or services relying on the FTP server.

Compliance Impact

This vulnerability causes server crashes due to race conditions, which could lead to denial of service and potential data unavailability. Such disruptions may impact compliance with GDPR (data availability requirements) and HIPAA (service continuity for protected health information).

Mitigation Strategies

Upgrade LightFTP to a patched version addressing the race condition. Apply CVE-2024-11144 fix if not already implemented. Restrict access to FTP services and monitor for unusual connection patterns. Disable unnecessary FTP features if possible.

Hi! I’m here to help you understand CVE-2026-67607. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70