CVE-2026-67607 Details
Description
LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.
A race condition vulnerability has been identified in LightFTP version 2.3.1, allowing remote attackers to crash the server. This vulnerability arises from an unsynchronized thread-state race in the 'worker_thread_cleanup' function. Attackers can exploit the re-check of 'WorkerThreadId' between 'worker_thread_cleanup()' and 'pthread_join()' without proper locking, causing 'pthread_join()' to reference an invalid thread ID and leading to a server crash. The vulnerability is exacerbated by a two-second sleep, which can be manipulated by an attacker. Notably, CVE-2024-11144 highlights an incomplete fix for this issue.
The recommended fix is to ensure that the 'worker_thread_cleanup' function holds the 'MTLock' mutex while checking the 'WorkerThreadValid' state and before calling 'pthread_join()', to synchronize access and prevent the race condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zeroscience/tuktam#real-world-case-study-lightftp-cve-2024-11144 | CISA-ADP | Technical Analysis |
| https://github.com/zeroscience/tuktam#real-world-case-study-lightftp-cve-2024-11144 | [email protected] | Technical Analysis |
| https://www.vulncheck.com/advisories/lightftp-race-condition-dos-via-worker-thread-cleanup | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| LightFTP | <= 2.3.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 3, 2026 | CVE Modified | [email protected] |
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |