Race Condition Vulnerability in LightFTP by ZeroScience
CVE-2026-67607

8.2HIGH

Key Information:

Vendor

Hfiref0x

Status
Lightftp
Vendor
CVE Published:
31 July 2026

What is CVE-2026-67607?

LightFTP 2.3.1 features a race condition that can be exploited by remote attackers to trigger server crashes. This occurs when an attacker creates a new connection that reuses the FTP context while an ABRT cleanup is in progress. The vulnerability arises from an unprotected re-check of WorkerThreadId between the cleanup function and the thread join operation, leading to potential systemic failures when the join call operates on an invalid thread ID. Previous mitigations have proven incomplete.

Affected Version(s)

LightFTP 0 <= 2.3.1

References

https://github.com/zeroscience/tuktam#real-world-case-stu...
technical-description
https://www.vulncheck.com/advisories/lightftp-race-condit...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Gjoko Krstic of Zero Science Lab
.