CVE-2026-67607 Overview
CVE-2026-67607 is a race condition vulnerability in LightFTP 2.3.1 that allows remote unauthenticated attackers to crash the daemon. The flaw resides in the worker_thread_cleanup() function within ftpserv.c. It represents an incomplete fix for CVE-2024-11144, where the previous patch narrowed the timing window but never added the missing mutex lock. Attackers exploit unsynchronized access to shared per-connection state and reused detached thread identifiers. The result is daemon destabilization or crash, producing a denial of service condition against the FTP service.
Critical Impact
Remote unauthenticated attackers can crash the LightFTP daemon by issuing a LIST command followed immediately by ABOR, causing service disruption.
Affected Products
- LightFTP version 2.3.1
- Prior LightFTP versions patched for CVE-2024-11144
- Deployments relying on the worker_thread_cleanup() code path in ftpserv.c
Discovery Timeline
- 2026-07-31 - CVE-2026-67607 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-67607
Vulnerability Analysis
The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition classified as [CWE-367]. LightFTP spawns detached worker threads to handle FTP data-transfer operations. When a client aborts an in-flight transfer, both the transfer thread and the control thread converge on shared per-connection state during cleanup. The worker_thread_cleanup() routine in ftpserv.c accesses this shared context without acquiring the mutex that protects it. The 2.3.1 patch for CVE-2024-11144 added an extra re-check and reordered cleanup operations, but it did not introduce the missing lock. As a result, concurrent threads can read and mutate freed or reassigned state, including reused detached thread identifiers.
Root Cause
The root cause is missing synchronization around shared per-connection cleanup state. The fix for CVE-2024-11144 shortened the exploitable window rather than serialising access with a mutex. Detached thread ID reuse compounds the issue by allowing stale identifiers to alias new threads during cleanup.
Attack Vector
A remote unauthenticated attacker connects to the FTP service and issues a data-transfer command such as LIST. The attacker immediately follows with an ABOR command to abort the transfer. The LIST worker thread and the ABOR handler race inside worker_thread_cleanup(), touching shared context without a lock. Repeated attempts reliably trigger daemon destabilization or a crash, denying service to legitimate users.
No public proof-of-concept exploit is listed for CVE-2026-67607. For technical detail on the underlying race, see the VulnCheck Advisory on LightFTP DoS and the GitHub Case Study on CVE-2024-11144.
Detection Methods for CVE-2026-67607
Indicators of Compromise
- Repeated FTP sessions from a single source that issue LIST followed by an immediate ABOR within milliseconds.
- Abrupt termination or restart of the LightFTP daemon process without an administrator-initiated shutdown.
- Core dumps or crash reports referencing worker_thread_cleanup() or ftpserv.c cleanup paths.
Detection Strategies
- Inspect FTP control channel traffic for high-frequency ABOR commands issued immediately after data-transfer commands.
- Correlate FTP process crash events with recent unauthenticated client connections in host telemetry.
- Alert on FTP daemon restarts that occur outside of scheduled maintenance windows.
Monitoring Recommendations
- Forward LightFTP logs and process lifecycle events to a centralised logging platform for cross-session analysis.
- Track connection rate and command sequence patterns per source IP address on TCP port 21.
- Monitor service availability with synthetic FTP transactions to detect daemon crashes quickly.
How to Mitigate CVE-2026-67607
Immediate Actions Required
- Restrict network exposure of LightFTP by allowing connections only from trusted source ranges via firewall rules.
- Place LightFTP behind a reverse proxy or rate limiter that throttles rapid LIST/ABOR command sequences.
- Enable automatic service supervision so the daemon restarts promptly after a crash.
Patch Information
At the time of publication, no vendor patch fully resolves CVE-2026-67607. The 2.3.1 release addressed CVE-2024-11144 but only narrowed the race window without adding the required mutex lock. Track the VulnCheck Advisory on LightFTP DoS for updates and apply a fixed release once the maintainer adds proper synchronization around worker_thread_cleanup().
Workarounds
- Disable anonymous FTP access and require authenticated sessions to reduce the pool of potential attackers.
- Deploy connection rate limiting and per-source command throttling at the network edge.
- Consider migrating critical file transfer workloads to an actively maintained FTP or SFTP server until a complete fix is available.
- Isolate the LightFTP host in a dedicated network segment to contain the impact of daemon crashes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
