CVE-2026-70637

LightFTP 2.4 contains data race vulnerabilities in ftpserv.c allowing anonymous attackers to trigger undefined behavior by issuing LIST followed by ABOR without authentication. The control thread may close data_socket and file_fd descriptors while worker threads concurrently access the same field...