CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-67607

LightFTP 2.3.1 is affected by a race-condition DoS vulnerability where a fresh FTP connection reuses context during an in-progress ABRT cleanup, exposing an unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside MTLock. This can cause pthread_join() to o...