CVE-2026-67607
Received Received - Intake

Race Condition in LightFTP Server Causes Denial of Service

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: VulnCheck

Description
LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-67607
EUVD
EUVD-2026-51558

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lightftp lightftp 2.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LightFTP 2.3.1 has a race condition flaw where remote attackers can crash the server. The issue occurs when a new connection reuses the FTP context while an ABRT cleanup is in progress. Attackers exploit an unprotected check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock, causing pthread_join() to use an invalid thread ID and crash the server.

Detection Guidance

Detecting this vulnerability requires monitoring for race conditions in LightFTP 2.3.1. Check for server crashes during concurrent connections or cleanup operations. Use network monitoring tools to observe FTP session behavior and thread management. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows remote attackers to cause a denial of service by crashing the LightFTP server. If exploited, it could disrupt file transfer services, leading to downtime and potential loss of access to critical data or services relying on the FTP server.

Compliance Impact

This vulnerability causes server crashes due to race conditions, which could lead to denial of service and potential data unavailability. Such disruptions may impact compliance with GDPR (data availability requirements) and HIPAA (service continuity for protected health information).

Mitigation Strategies

Upgrade LightFTP to a patched version addressing the race condition. Apply CVE-2024-11144 fix if not already implemented. Restrict access to FTP services and monitor for unusual connection patterns. Disable unnecessary FTP features if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-67607. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart