CVE-2026-70637 describes multiple data race vulnerabilities in LightFTP through version 4.0, specifically in the ftpserv.c file. Anonymous attackers can trigger undefined behavior by sending LIST commands followed by ABOR commands without authenticating. The root cause is a lack of synchronization between the control thread and worker threads: the control thread closes data_socket and file_fd descriptors while worker threads may still operate on these descriptors concurrently in worker_thread_cleanup. This race condition can lead to stale file descriptors being reassigned by the operating system and subsequently misused by worker threads on unrelated resources, resulting in potential denial of service.

The vulnerability allows unauthenticated attackers to cause undefined behavior and potential denial of service by exploiting race conditions in descriptor handling. This can disrupt the normal operation of the LightFTP server, impacting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restricting anonymous access or disabling LIST and ABOR commands for unauthenticated users may reduce exposure, but these are not confirmed mitigations.