CVE-2026-70637: CWE-820 Missing Synchronization in hfiref0x LightFTP
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
AI Analysis
Technical Summary
CVE-2026-70637 describes multiple data race conditions in LightFTP through version 4.0, specifically in the ftpserv.c source file. Anonymous attackers can exploit the race by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently access these same descriptors in worker_thread_cleanup. This concurrency flaw can cause stale file descriptors to be reassigned by the operating system and subsequently misused by worker threads on unrelated resources, resulting in undefined behavior and potential denial of service.
Potential Impact
The vulnerability allows unauthenticated attackers to cause undefined behavior and potentially deny service by exploiting race conditions in file descriptor handling. This can disrupt normal FTP server operations and degrade service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restricting anonymous access or disabling LIST and ABOR commands for anonymous users may reduce exposure.
CVE-2026-70637: CWE-820 Missing Synchronization in hfiref0x LightFTP
Description
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
CVSS v4.0
Score 8.2high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-70637 describes multiple data race conditions in LightFTP through version 4.0, specifically in the ftpserv.c source file. Anonymous attackers can exploit the race by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently access these same descriptors in worker_thread_cleanup. This concurrency flaw can cause stale file descriptors to be reassigned by the operating system and subsequently misused by worker threads on unrelated resources, resulting in undefined behavior and potential denial of service.
Potential Impact
The vulnerability allows unauthenticated attackers to cause undefined behavior and potentially deny service by exploiting race conditions in file descriptor handling. This can disrupt normal FTP server operations and degrade service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restricting anonymous access or disabling LIST and ABOR commands for anonymous users may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-04T20:17:18.298Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a749d44bf8831d539dba900
Added to database: 08/06/2026, 14:42:12 UTC
Last enriched: 08/06/2026, 14:56:17 UTC
Last updated: 08/06/2026, 15:41:52 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.