CVE-2026-70637 Details

A data race vulnerability has been identified in LightFTP versions through 2.4, specifically within the ftpserv.c file. This vulnerability allows anonymous attackers to cause undefined behavior by sending LIST commands followed by ABOR commands, without authentication. The issue arises because the control thread closes data_socket and file_fd descriptors while worker threads are still using the same fields, leading to a race condition. This allows stale file descriptors to be reassigned by the operating system and used by worker threads on unrelated resources, potentially causing a denial-of-service condition.

To address this vulnerability, synchronize access to the shared context fields using a mutex and make the worker_thread_abort flag atomic. Ensure that the close operations in worker_thread_cleanup are protected by the mutex and that the file descriptors are invalidated atomically before releasing the mutex, allowing the worker thread to detect the change before the next input/output operation.