CVE-2026-70637 hfiref0x CVE debrief

Who should care

System administrators and security teams responsible for LightFTP installations should be aware of this vulnerability. Due to the HIGH CVSS score of 8.2, immediate attention is required to address potential denial of service vulnerabilities. Developers and security researchers interested in FTP server security and data race vulnerabilities should also take note.

Technical summary

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c. These vulnerabilities allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup. This allows stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

Defensive priority

High-priority defensive actions are recommended due to the HIGH CVSS score of 8.2. Immediate attention is required to address potential denial of service vulnerabilities in LightFTP through 2.4.

Recommended defensive actions

• Inventory and assess LightFTP installations for version 2.4 or earlier.
• Apply vendor patches or updates if available.
• Implement compensating controls such as limiting access to FTP services.
• Monitor for suspicious activity related to LIST and ABOR commands.
• Consider replacing LightFTP with a more secure alternative if patches are not available.

Evidence notes

Evidence from official sources indicates multiple data race vulnerabilities in LightFTP through 2.4, specifically in ftpserv.c, which allow anonymous attackers to cause undefined behavior. The vulnerabilities are exploitable by issuing LIST followed by ABOR commands without authentication, potentially leading to denial of service.

Official resources