What is GHSA-857x-mm78-cq2m?

GHSA-857x-mm78-cq2m is a security advisory published by GitHub Security Advisories with High severity. LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the...

Which CVE IDs does GHSA-857x-mm78-cq2m cover?

GHSA-857x-mm78-cq2m covers the following CVE IDs: CVE-2026-67607. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-857x-mm78-cq2m?

GHSA-857x-mm78-cq2m has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-857x-mm78-cq2mHighCVSS 5.9

LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the...

Vendor

GitHub Security Advisories

Published

July 31, 2026

Last Modified

July 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-67607 →

📋 Description

LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between worker_thread_cleanup() and pthread_join() outside of MTLock to cause pthread_join() to operate on an invalid thread ID, resulting in a server crash. CVE-2024-11144 identifies an incomplete fix of this vulnerability.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-67607
https://github.com/zeroscience/tuktam#real-world-case-study-lightftp-cve-2024-11144
https://www.vulncheck.com/advisories/lightftp-race-condition-dos-via-worker-thread-cleanup
https://github.com/advisories/GHSA-857x-mm78-cq2m