CVE-2026-67607

Name of the Vulnerable Software and Affected Versions LightFTP version 2.3.1

Description A race condition exists in the worker thread cleanup() function of ftpserv.c. This occurs when remote unauthenticated attackers trigger unsynchronized access to shared per-connection state without the required mutex lock. By sending a data-transfer command like LIST followed immediately by ABOR, an attacker can exploit missing synchronization on shared context and detached thread id reuse. This leads to daemon destabilization or a crash, resulting in a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.