Vulnerability details
CVE-2026-70637
hfiref0x LightFTP
LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c
CVSS 4.0
8.2High
Official description
LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 5.9Medium | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| hfiref0x | LightFTP | v ≤ 2.4 | CVEProject cvelistV5 (CNA) |
| hfiref0x | LightFTP | v ≤ d28c5e08aa4bd128737d35cc6ee0f9630a910ed5 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/hfiref0x/LightFTP/issues/75 technical-descriptionexploitissue-tracking
- https://www.vulncheck.com/advisories/lightftp-data-race-condition-via-abor-command-in-ftpserv-c third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-06
- Last updated
- 2026-11-08
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
30.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-820Missing Synchronization