Which versions of LightFTP are affected by CVE-2026-67607?

LightFTP 2.3.1 is vulnerable to a denial-of-service attack (CVSS 8.2) triggered by unauthenticated remote attackers exploiting a timing flaw in thread cleanup, causing server crashes.

Is there a public PoC exploit available for CVE-2026-67607?

Yes, a public proof-of-concept exploit is available for CVE-2026-67607. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-67607?

Within 24 hours, identify all systems running LightFTP 2.3.1 and implement network-level access controls via IP allowlisting and firewall restrictions to limit exposure to trusted internal sources only. Within 7 days, evaluate alternative FTP server solutions and test candidates in a non-production environment to establish a migration timeline. Within 30 days, execute a planned migration away from LightFTP 2.3.1 to the selected replacement solution in production.

LightFTP CVE-2026-67607

Q: What is the CVSS score of CVE-2026-67607?

CVE-2026-67607 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-51558 HIGH

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-07-31 disclosure@vulncheck.com

GHSA-857x-mm78-cq2m

Denial Of Service

8.2

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable unauthenticated, but AC:H for timing-dependent race; impact is process crash only, no scope change or C/I impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 16:35 vuln.today

CVE Published

Jul 31, 2026 - 16:17 cve.org

HIGH 8.2

DescriptionCVE.org

LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.

AnalysisAI

Server crash in LightFTP 2.3.1 is remotely triggerable by unauthenticated attackers exploiting a TOCTOU race condition in the ABRT cleanup path, enabling denial-of-service without credentials. The flaw arises because WorkerThreadId is re-checked outside the MTLock mutex between worker_thread_cleanup() and pthread_join(), allowing a racing new connection to cause pthread_join() to operate on an invalid thread ID. No active exploitation is confirmed (not in CISA KEV), though a related case study for CVE-2024-11144 - a prior incomplete fix of this same flaw - exists in the zeroscience/tuktam repository.

Technical ContextAI

LightFTP is a lightweight open-source FTP server written in C using POSIX threads (pthreads). The vulnerability is classified as CWE-367 (Time-of-Check Time-of-Use / TOCTOU), a class of concurrency flaw where a shared resource is read for a condition check and then used, but another thread can modify that resource between the check and the use. Specifically, worker_thread_cleanup() reads WorkerThreadId and then calls pthread_join() on it, but this check-then-use sequence is not protected by the MTLock mutex. A concurrent new FTP connection that reuses the same FTP context can interleave between the check and the join call, passing an invalid or already-recycled thread ID to pthread_join(). On most POSIX implementations, calling pthread_join() on an invalid thread ID results in undefined behavior manifesting as a process crash. The note that CVE-2024-11144 was an incomplete fix indicates the mutex gap has persisted across at least one prior remediation attempt.

RemediationAI

No vendor-released patch version for CVE-2026-67607 was identified in the available data at time of analysis. The primary compensating control is to restrict network access to the LightFTP service to trusted IP ranges using host-based firewall rules or network ACLs blocking untrusted clients from reaching TCP port 21; this directly eliminates the network attack vector without requiring a code change, though it limits the service's accessibility. If public FTP access is operationally required, deploying a reverse proxy or connection-rate-limiting layer in front of LightFTP can reduce an attacker's ability to establish the rapid concurrent connections needed to win the race. Monitor the VulnCheck advisory at https://www.vulncheck.com/advisories/lightftp-race-condition-dos-via-worker-thread-cleanup and the upstream LightFTP project for a patched release. Given that CVE-2024-11144 was already an incomplete fix of the same root cause, any future patch should be validated under concurrent connection load testing before being considered definitive.