CVE-2026-70637
Received Received - Intake

LightFTP 2.4 Multiple Data Race Vulnerabilities

Publication date: 2026-08-06

Last updated on: 2026-08-06

Assigner: VulnCheck

Description
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-06
Last Modified
2026-08-06
Generated
2026-08-06
AI Q&A
2026-08-06
EPSS Evaluated
N/A
NVD
CVE-2026-70637
EUVD
EUVD-2026-53933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
lightftp lightftp to 2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-820 The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

LightFTP through version 2.4 has multiple data race vulnerabilities in ftpserv.c. Unauthenticated attackers can cause undefined behavior by sending LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently use these fields, allowing the OS to reassign stale descriptors. Worker threads may then use these reassigned descriptors on unrelated resources, leading to potential denial of service.

Detection Guidance

To detect this vulnerability, monitor for unusual FTP session behavior such as rapid LIST followed by ABOR commands from unauthenticated users. Check LightFTP logs for errors related to file descriptor reuse or worker thread crashes. Use network monitoring tools like tcpdump to capture FTP traffic patterns matching the described attack sequence.

Impact Analysis

This vulnerability can cause denial of service by crashing the FTP server or corrupting data. It may also lead to data leakage between sessions if worker threads write to incorrect resources due to reassigned file descriptors. The impact includes potential file corruption, unauthorized access to other users' data, or server instability.

Compliance Impact

This vulnerability could violate compliance with GDPR and HIPAA by enabling data leakage or unauthorized access to sensitive information. GDPR requires protecting personal data integrity and confidentiality, while HIPAA mandates safeguarding protected health information. A successful exploit could result in unauthorized data exposure, leading to regulatory penalties or breaches of compliance requirements.

Mitigation Strategies

Immediately update LightFTP to the latest patched version. If updating is not possible, disable the ABOR command in the FTP server configuration to prevent the attack vector. Implement network-level controls to block unauthorized FTP commands from unauthenticated sources. Monitor server logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-70637. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart