← Advisories

LightFTP Server 2.3.1 Race Condition

Medium
Advisory ID
ZSL-2026-6001
Release Date
04 August 2026
Vendor
Affected Version
2.3.1
Tested On
Kali Linux
Summary

Small x86-32/x64 FTP Server.

Description

LightFTP 2.3.1 contains a residual race condition (an incomplete fix for CVE-2024-11144) in the worker_thread_cleanup() function of ftpserv.c. The control thread reads and acts on shared per-connection state, including the worker thread id it then passes to pthread_join()/pthread_cancel(), without holding the context->MTLock mutex that the worker threads use when updating that same state; and because the workers are detached, their thread id can be reused once they exit.

A remote (anonymous) client triggers the window by starting a data-transfer command such as LIST and immediately issuing ABOR, running the unsynchronized cleanup while the worker is still finishing. ThreadSanitizer confirms multiple data races on the shared context and a mutex being destroyed while still in use, and the cleanup joins or cancels a detached, potentially reused thread id, which is undefined behavior that can destabilize or crash the daemon and result in denial of service. The 2.3.1 patch only narrowed the timing window (an extra re-check and reordered cleanup); it never added the missing lock, so the underlying race remains.

Proof of Concept
Disclosure Timeline
29.07.2026Vulnerability discovered.
30.07.2026Submitted to VulnCheck for coordination.
04.08.2026Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
04.08.2026Initial release