Every CVE Search/ Get API key

CVE-2026-85234

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

7.5 HighFix available

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.47%Unchanged since Sep 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
CVE-2026-85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-06
EUVDEUVD-2026-79128 7.5

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
EUVD-2026-79128
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-06
GitHub AdvisoriesGHSA-rxqq-3mgh-v3m7 7.5

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule...

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
GHSA-rxqq-3mgh-v3m7
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 7.5

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
CVE-2026-85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-06
OSVDEBIAN-CVE-2026-85234 7.5

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
DEBIAN-CVE-2026-85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2026-4658 7.5

tftp security update

TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.

Security Fix(es):

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)

Record
OESA-2026-4658
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
Show 13 moreShow less
OSVOESA-2026-4659 7.5

tftp security update

TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.

Security Fix(es):

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)

Record
OESA-2026-4659
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVOESA-2026-4660 7.5

tftp security update

TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.

Security Fix(es):

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)

Record
OESA-2026-4660
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-04
OSVRHSA-2026:78952 7.5

Red Hat Security Advisory: tftp security update

Record
RHSA-2026:78952
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:80663 7.5

Red Hat Security Advisory: tftp security update

Record
RHSA-2026:80663
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:82280 7.5

Red Hat Security Advisory: tftp security update

Record
RHSA-2026:82280
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:78952 7.5

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:78952
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:80663 7.5

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:80663
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:82280 7.5

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:82280
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-85234 7.5

A flaw was found in tftp-hpa. When the in.tftpd remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the genmatchstring() function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Record
UBUNTU-CVE-2026-85234
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:78952 No score

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:78952
Updated
2026-11-02
OSVALSA-2026:80663 No score

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:80663
Updated
2026-11-02
OSVALSA-2026:82280 No score

Moderate: tftp security update

The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.

Security Fix(es):

  • tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:82280
Updated
2026-11-02
OSVopenSUSE-SU-2026:12412-1 No score

tftp-5.4-1.1 on GA media

These are all security issues fixed in the tftp-5.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12412-1
Updated
2026-11-04

Affected products

Affected packages

Affected packages
PackageAffectedFixed
tftp
AlmaLinux:8
 before 5.2-28.el8_10
5.2-28.el8_10
tftp-server
AlmaLinux:8
 before 5.2-28.el8_10
5.2-28.el8_10
tftp
AlmaLinux:9
 before 5.2-40.el9_8.1
5.2-40.el9_8.1
tftp-server
AlmaLinux:9
 before 5.2-40.el9_8.1
5.2-40.el9_8.1
tftp
AlmaLinux:10
 before 5.2-50.el10_2
5.2-50.el10_2
tftp-server
AlmaLinux:10
 before 5.2-50.el10_2
5.2-50.el10_2
tftp-hpa
Debian:12
 All versions, plus listed versions
5.2+20150808-1.45.2+20150808-25.2+20240610-15.2+20240610-25.2+20240610-3
Show 12 moreShow less
5.3+20251110-15.3+20251116-15.3+20251209-15.3+20251209-25.4-15.4-27.1-17.2+20261013-17.2+20261013-27.2-17.2-27.2-3
 None known
tftp-hpa
Debian:13
 All versions, plus listed versions
5.2+20240610-35.3+20251110-15.3+20251116-15.3+20251209-15.3+20251209-2
Show 8 moreShow less
5.4-15.4-27.1-17.2+20261013-17.2+20261013-27.2-17.2-27.2-3
 None known
tftp-hpa
Debian:14
 before 5.3+20251116-1, plus listed versions
5.2+20240610-35.3+20251110-1
5.3+20251116-1
tftp
openEuler:22.03-LTS-SP4
 before 5.2-33.oe2203sp4
5.2-33.oe2203sp4
Show 29 moreShow less
Affected packages
PackageAffectedFixed
tftp
openEuler:24.03-LTS-SP1
 before 5.2-33.oe2403sp1
5.2-33.oe2403sp1
tftp
openEuler:24.03-LTS-SP3
 before 5.2-33.oe2403sp3
5.2-33.oe2403sp3
tftp
Red Hat:enterprise_linux:8::appstream
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp-server
Red Hat:enterprise_linux:8::appstream
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp-server-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp
Red Hat:enterprise_linux:9::appstream
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp-server
Red Hat:enterprise_linux:9::appstream
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp-server-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp
Red Hat:enterprise_linux:10.2
 before 0:5.2-50.el10_2
0:5.2-50.el10_2
tftp-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:5.2-50.el10_2
0:5.2-50.el10_2
tftp-debugsource
Red Hat:enterprise_linux:10.2
 before 0:5.2-50.el10_2
0:5.2-50.el10_2
tftp-server
Red Hat:enterprise_linux:10.2
 before 0:5.2-50.el10_2
0:5.2-50.el10_2
tftp-server-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:5.2-50.el10_2
0:5.2-50.el10_2
tftp
Rocky Linux:8
 before 0:5.2-28.el8_10
0:5.2-28.el8_10
tftp
Rocky Linux:9
 before 0:5.2-40.el9_8.1
0:5.2-40.el9_8.1
tftp
Rocky Linux:10
 before 0:5.2-50.el10
0:5.2-50.el10
tftp-hpa
Ubuntu:14.04:LTS
 All versions, plus listed versions
5.2-7ubuntu35.2-7ubuntu3.1
 None known
tftp-hpa
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.2+20140608-3ubuntu15.2+20150808-1ubuntu15.2+20150808-1ubuntu1.16.04.1
 None known
tftp-hpa
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.2+20150808-1ubuntu3
 None known
tftp-hpa
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.2+20150808-1ubuntu35.2+20150808-1ubuntu4
 None known
tftp-hpa
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.2+20150808-1.2build15.2+20150808-1.2build2
 None known
tftp-hpa
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.2+20150808-1.45.2+20150808-1.4build1
 None known
tftp-hpa
Ubuntu:26.10
 All versions, plus listed versions
5.3+20251209-25.4-15.4-2
 None known
tftp-hpa
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.2+20240610-35.3+20251110-15.3+20251116-15.3+20251209-15.3+20251209-2
 None known
tftp
openSUSE:Tumbleweed
 before 5.4-1.1
5.4-1.1

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, facts, referencesOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-85234 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 40th percentile. Fixed in tftp 5.2-28.el8_10.

References

Show 20 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open