CVE-2026-67607

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67607

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67607.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67607

Published

2026-07-31T15:59:10.564Z

Modified

2026-08-15T04:06:50.166575428Z

Severity

8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

Details

LightFTP 2.3.1 contains a residual race condition vulnerability (an incomplete fix for CVE-2024-11144) in the workerthreadcleanup() function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state without holding the required mutex lock. Attackers can send a data-transfer command such as LIST followed immediately by ABOR to exploit the missing synchronization on shared context and detached thread id reuse, resulting in daemon destabilization or crash which can lead to a denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup), it never added the missing lock, so the underlying race remains.

Database specific

{
    "cna_assigner": "VulnCheck",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67607.json",
    "cwe_ids": [
        "CWE-367"
    ]
}

References

Affected packages

Git / github.com/hfiref0x/lightftp

Affected ranges

Type

GIT

Repo

https://github.com/hfiref0x/lightftp

Events

Introduced

Last affected

9a6128d06e08919e7a1731a88578a5d1506a947b

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.3.1"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v1.*

v1.0

v1.1

v2.*

v2.0

v2.1

v2.2

v2.3

v2.3.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67607.json"