CVE-2026-70637

Name of the Vulnerable Software and Affected Versions LightFTP versions prior to 2.5

Description Multiple data race conditions exist in the ftpserv.c file. An unauthenticated anonymous attacker can trigger undefined behavior by sending a LIST command followed by an ABOR command. This occurs because the control thread closes the data socket and file fd descriptors while worker threads are simultaneously accessing these same fields within the worker thread cleanup() function. Consequently, the operating system may reassign these stale file descriptors, which worker threads might then use on unrelated resources, potentially leading to a denial of service.

Recommendations Update LightFTP to a version newer than 2.4.