CVE-2026-70637

Katalog CVE

CVSS 5.9 · Medium EPSS 0,37%

Kerentanan Missing Synchronization. Skor CVSS 3.1 5.9 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descriptors while worker threads concurrently operate on the same fields in worker_thread_cleanup, allowing stale file descriptors to be reassigned by the OS and subsequently used by worker threads on unrelated resources, resulting in potential denial of service.

Rincian

Terbit di NVD

6 Agustus 2026

Terakhir diubah

24 September 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-820: Missing Synchronization

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/hfiref0x/LightFTP/issues/75
• https://www.vulncheck.com/advisories/lightftp-data-race-condition-via-abor-command-in-ftpserv-c