Small x86-32/x64 FTP Server.
LightFTP through version 2.4 (current master, commit d28c5e0) contains multiple data races in ftpserv.c caused by unsynchronized access to the shared FTPCONTEXT between a connection's control thread and its data-transfer worker thread. In worker_thread_cleanup(), invoked by the anonymous-reachable ABOR command, the control thread reads and writes context->data_socket, context->data_ipv4, and context->worker_thread_abort with no lock, while the detached worker thread (list_thread and its siblings) concurrently uses the same data socket and writes context->worker_thread_valid.
Version 2.4 removed the MTLock mutex that previously guarded this state and replaced it with an atomic busy compare-and-swap that only serializes worker startup, not cleanup against a running worker, so the control thread closes and clears the data connection while the worker is still operating on it. ThreadSanitizer confirms data races at at least 16 distinct source locations (5 in worker_thread_cleanup), reproducible by an anonymous user with LIST followed by ABOR. The per-run report count is higher and scales with concurrency. The impact is undefined behavior with potential denial of service; a crash on a standard release build was not demonstrated.