Which versions of LightFTP are affected by CVE-2026-70637?

LightFTP versions through 2.4 are vulnerable to unauthenticated remote denial of service attacks triggered by specific FTP command sequences.

Is there a public PoC exploit available for CVE-2026-70637?

Yes, a public proof-of-concept exploit is available for CVE-2026-70637. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-70637?

Within 24 hours, conduct a complete inventory of LightFTP deployments and identify which are accessible from untrusted networks; immediately restrict FTP access to trusted IP ranges via firewall or network ACLs. Within 7 days, implement connection rate limiting on port 21, deploy process monitoring and automatic restart for ftpserv crashes, and baseline normal command patterns to detect exploit attempts. Within 30 days, establish direct vendor communication to track patch availability, evaluate alternative FTP servers with active maintenance (ProFTPD, vsftpd), and develop a migration plan; for critical deployments, prepare failover FTP infrastructure or identify workarounds (SFTP substitution if feasible).

LightFTP CVE-2026-70637

Q: What is the CVSS score of CVE-2026-70637?

CVE-2026-70637 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53933 HIGH

Missing Synchronization (CWE-820)

2026-08-06 VulnCheck

GHSA-6269-2q48-xxqm

Denial Of Service Lightftp

8.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-reachable anonymous attack (AV:N, PR:N) but race condition requires timing precision (AC:H); impact is availability-only crash with no confidentiality or integrity loss (C:N/I:N/A:H, S:U).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:17 vuln.today

CVE Published

Aug 06, 2026 - 14:15 cve.org

HIGH 8.2

DescriptionCVE.org

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

AnalysisAI

Unauthenticated remote denial of service in LightFTP through version 2.4 exploits multiple data race conditions in ftpserv.c via the LIST/ABOR command sequence. The control thread closes shared data_socket and file_fd descriptors while worker threads concurrently reference the same fields in worker_thread_cleanup, enabling the OS to reassign stale descriptors to unrelated resources and producing undefined behavior. A publicly available proof-of-concept exists (GitHub issue #75); exploitation has not been confirmed in the wild (not in CISA KEV), but the unauthenticated attack surface and CVSS 4.0 score of 8.2 elevate urgency for exposed deployments.

Technical ContextAI

LightFTP (hfiref0x/LightFTP) is a compact, open-source FTP server whose protocol handling logic resides in ftpserv.c. The vulnerability class is CWE-820 (Missing Synchronization): the server spawns a control thread and separate worker threads that share mutable state - specifically data_socket and file_fd file descriptor fields - without adequate locking or memory-ordering guarantees. When a client issues LIST to initiate a data transfer and then ABOR to abort it, the control thread races with worker_thread_cleanup, each operating on those shared descriptors concurrently. Because the OS may immediately reassign a closed file descriptor number to a new resource (e.g., an unrelated socket or file), the worker thread subsequently performs I/O on the wrong resource, leading to undefined behavior and server crash. The CPE cpe:2.3:a:hfiref0x:lightftp:*:*:*:*:*:*:*:* covers all tracked versions through 2.4. This is a classic TOCTOU-adjacent descriptor-reuse race, made exploitable remotely because anonymous FTP sessions can trigger the LIST/ABOR sequence without credentials.

RemediationAI

No patched release version is identified in the available input data; the upstream fix status is unconfirmed - the GitHub issue at https://github.com/hfiref0x/LightFTP/issues/75 documents the race but no tagged patched release is referenced. Operators should monitor the LightFTP repository for a fix and upgrade immediately upon release. As compensating controls: disable anonymous FTP access entirely if it is not operationally required, since the attack requires no credentials and anonymous access is the primary enabling condition; restrict FTP port access (default TCP 21) at the network perimeter to known trusted source IPs using firewall ACLs, accepting the trade-off of reduced public FTP accessibility; or migrate to an actively maintained FTP server with synchronization primitives protecting shared file descriptor state. These controls do not eliminate the underlying race condition but meaningfully reduce the exposed attack surface until a patch is available.