CVE-2026-70637 in LightFTP
Summary
by MITRE • 08/06/2026
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
This vulnerability resides in LightFTP version 2.4 and represents a critical data race condition within the ftpserv.c source file that fundamentally compromises the application's stability and security posture. The flaw manifests when anonymous attackers exploit the sequence of issuing LIST followed by ABOR commands without proper authentication, creating a scenario where concurrent execution paths collide. The control thread manages the cleanup process by closing data_socket and file_fd descriptors while worker threads continue operating on these same memory locations during the worker_thread_cleanup function execution. This race condition creates a window where the operating system may reassign the closed file descriptor numbers to new resources, leading to a dangerous state where worker threads inadvertently operate on unrelated file handles that were previously associated with different connections or sessions.
The technical implementation of this vulnerability aligns with CWE-362, which specifically addresses concurrent execution use of shared resource vulnerabilities. The flaw occurs at the intersection of thread synchronization and resource management, where proper mutex locking or atomic operations should prevent simultaneous access to critical data structures. When the control thread closes file descriptors and the worker threads continue processing, this creates a classic race condition that results in undefined behavior patterns. The attack vector is particularly insidious because it requires no authentication, making it accessible to anonymous users who can simply connect to the FTP server and execute the specific command sequence to trigger the vulnerability.
The operational impact of this vulnerability extends beyond simple denial of service to potentially enable more sophisticated attacks through resource manipulation. When stale file descriptors are reassigned to new resources, worker threads may inadvertently access or modify data that belongs to other legitimate users or system components, creating potential information disclosure risks or system instability. The denial of service aspect manifests as the application becoming unresponsive or crashing when worker threads attempt to operate on incorrectly reassigned file handles, effectively rendering the FTP service unavailable to legitimate users. This vulnerability particularly affects environments where LightFTP serves multiple concurrent connections and where anonymous access is permitted, making it a significant concern for public-facing FTP servers.
Mitigation strategies must address both the immediate security gap and the underlying architectural issues that enable this race condition. The most effective approach involves implementing proper thread synchronization mechanisms such as mutex locks around critical sections where file descriptor operations occur, ensuring that worker threads cannot access or modify data structures while the control thread is performing cleanup operations. Additionally, developers should implement proper resource management protocols that prevent descriptor reuse until all related threads have completed their operations, potentially through reference counting or connection lifecycle management approaches. The solution should also include proper input validation and command sequencing checks to prevent unauthorized users from triggering these specific command patterns without authentication, while maintaining the application's core functionality for legitimate users. This vulnerability demonstrates the importance of rigorous thread safety testing in network services and highlights the critical need for proper concurrency control mechanisms in multi-threaded server applications.