# CVE-2026-70637: LightFTP data race condition in ftpserv.c

Source: https://junglewise.ai/threats/cve-2026-70637-lightftp-data-race-condition-in-ftpserv-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-06. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-70637 · Severity: medium · CVSS 5.9 · Published 2026-08-06

LightFTP is an open-source FTP server that handles file transfers over the network. A race condition in the server's file descriptor handling allows unauthenticated attackers to crash the service by sending LIST and ABOR commands in quick succession, causing the server to close file handles while worker threads are still using them. This leads to denial of service and potential undefined behavior.

Technologies: [Hfiref0x LightFTP](https://junglewise.ai/threats/technologies/lightftp). Vendors: [Hfiref0x](https://junglewise.ai/threats/vendors/hfiref0x).

## Quick answers

**Is CVE-2026-70637 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70637 being exploited in the wild.

**How severe is CVE-2026-70637?** Medium severity, with a CVSS score of 5.9, published 6 August 2026.

**Which products and versions are affected?** Hfiref0x LightFTP through 2.4.

**Is there a fix for CVE-2026-70637?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-70637 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-70637?** Check whether you run Hfiref0x LightFTP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a data race condition (CWE-820: Missing Synchronization) in ftpserv.c where the control thread and worker threads access shared FTP context fields (data_socket, file_fd, worker_thread_abort) without mutex protection. When the ABOR command is issued, worker_thread_cleanup() closes file descriptors while transfer worker threads (stor_thread, retr_thread, list_thread) are still actively using them, creating a use-after-close window of approximately 500ms. The closed file descriptors can be reused by the OS and reassigned to unrelated resources, causing the worker threads to operate on stale descriptors. The vulnerability requires no authentication and can be triggered via FTP commands sent over the network. ThreadSanitizer analysis confirms multiple concurrent fd-close races. The issue affects LightFTP through version 2.4.

## Affected products

- hfiref0x LightFTP through 2.4

## Timeline

- 2026-08-06: disclosed: CVE-2026-70637 published
- 2026-06-22: other: Security issue #75 reported on GitHub

## References

- [https://github.com/hfiref0x/LightFTP/issues/75](https://github.com/hfiref0x/LightFTP/issues/75)
- [https://www.vulncheck.com/advisories/lightftp-data-race-condition-via-abor-command-in-ftpserv-c](https://www.vulncheck.com/advisories/lightftp-data-race-condition-via-abor-command-in-ftpserv-c)

## Related threats

- [hfiref0x LightFTP race condition in worker thread cleanup](https://junglewise.ai/threats/cve-2026-67607-hfiref0x-lightftp-race-condition-in-worker-thread-cleanup)
- [A buffer overflow in the g_cfg.MaxUsers component of LightFTP v2.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.](https://junglewise.ai/threats/cve-2025-65403-a-buffer-overflow-in-the-g-cfg-maxusers-component-of-lightftp-v2)