Grant_Y

**Name of the Vulnerable Software and Affected Versions** LightFTP versions prior to 2.5 **Description** Multiple data race conditions exist in the `ftpserv.c` file. An unauthenticated anonymous attacker can trigger undefined behavior by sending a LIST command followed by an ABOR command. This occurs because the control thread closes the `data socket` and `file fd` descriptors while worker threads are simultaneously accessing these same fields within the `worker thread cleanup()` function. Consequently, the operating system may reassign these stale file descriptors, which worker threads might then use on unrelated resources, potentially leading to a denial of service. **Recommendations** Update LightFTP to a version newer than 2.4.