Executive brief
LightFTP is an open-source FTP server that handles file transfers over the network. A race condition in the server's file descriptor handling allows unauthenticated attackers to crash the service by sending LIST and ABOR commands in quick succession, causing the server to close file handles while worker threads are still using them. This leads to denial of service and potential undefined behavior.
Technical details
The vulnerability is a data race condition (CWE-820: Missing Synchronization) in ftpserv.c where the control thread and worker threads access shared FTP context fields (data_socket, file_fd, worker_thread_abort) without mutex protection. When the ABOR command is issued, worker_thread_cleanup() closes file descriptors while transfer worker threads (stor_thread, retr_thread, list_thread) are still actively using them, creating a use-after-close window of approximately 500ms. The closed file descriptors can be reused by the OS and reassigned to unrelated resources, causing the worker threads to operate on stale descriptors. The vulnerability requires no authentication and can be triggered via FTP commands sent over the network. ThreadSanitizer analysis confirms multiple concurrent fd-close races. The issue affects LightFTP through version 2.4.
Affected products
- hfiref0x LightFTP through 2.4
Timeline
- 2026-08-06: disclosed: CVE-2026-70637 published
- 2026-06-22: other: Security issue #75 reported on GitHub