← Advisories

LightFTP Server 2.4 Race Condition

Medium
Advisory ID
ZSL-2026-6002
Release Date
07 August 2026
Vendor
Affected Version
2.4 (d28c5e0)
Tested On
Kali Linux
Summary

Small x86-32/x64 FTP Server.

Description

LightFTP through version 2.4 (current master, commit d28c5e0) contains multiple data races in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. In worker_thread_cleanup(), invoked by the anonymous-reachable ABOR command, the control thread reads and writes context->data_socket, context->data_ipv4, and context->worker_thread_abort with no lock, while the detached worker thread (list_thread and its siblings) concurrently uses the same data socket and writes context->worker_thread_valid.

Version 2.4 removed the MTLock mutex that previously guarded this state and replaced it with an atomic busy compare-and-swap that only serializes worker startup, not cleanup against a running worker, so the control thread closes and clears the data connection while the worker is still operating on it. ThreadSanitizer confirms data races at at least 16 distinct source locations (5 in worker_thread_cleanup), reproducible by an anonymous user with LIST followed by ABOR. The per-run report count is higher and scales with concurrency. The impact is undefined behavior with potential denial of service; a crash on a standard release build was not demonstrated.

Proof of Concept
Disclosure Timeline
29.07.2026Vulnerability discovered.
30.07.2026Submitted to VulnCheck for coordination.
07.08.2026Coordinated public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
07.08.2026Initial release
08.08.2026Added reference [11]