{"id":"CVE-2026-85234","aliases":["ALSA-2026:78952","ALSA-2026:80663","ALSA-2026:82280","DEBIAN-CVE-2026-85234","EUVD-2026-79128","GHSA-rxqq-3mgh-v3m7","OESA-2026-4658","OESA-2026-4659","OESA-2026-4660","OESA-2026-4853","RHSA-2026:78952","RHSA-2026:80663","RHSA-2026:82280","RLSA-2026:78952","RLSA-2026:80663","RLSA-2026:82280","UBUNTU-CVE-2026-85234","openSUSE-SU-2026:12412-1"],"status":"published","title":"Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0047,"percentile":0.40954,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-09-15T17:58:51Z","modified":"2026-11-11T12:59:13Z","fixes":[{"ecosystem":"AlmaLinux:8","package":"tftp","fixed_in":["5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tftp-server","fixed_in":["5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tftp","fixed_in":["5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"tftp-server","fixed_in":["5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tftp","fixed_in":["5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"tftp-server","fixed_in":["5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"tftp-hpa","fixed_in":["5.3+20251116-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"tftp","fixed_in":["5.2-33.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"tftp","fixed_in":["5.2-33.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"tftp","fixed_in":["5.2-33.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP4","package":"tftp","fixed_in":["5.2-33.oe2403sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-debuginfo","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-debugsource","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-server","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-server-debuginfo","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-debuginfo","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-debugsource","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-server","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-server-debuginfo","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp","fixed_in":["0:5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-debuginfo","fixed_in":["0:5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-debugsource","fixed_in":["0:5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-server","fixed_in":["0:5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-server-debuginfo","fixed_in":["0:5.2-50.el10_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tftp","fixed_in":["0:5.2-28.el8_10"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"tftp","fixed_in":["0:5.2-40.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"tftp","fixed_in":["0:5.2-50.el10"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tftp","fixed_in":["5.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20150808-1.4","5.2+20150808-2","5.2+20240610-1","5.2+20240610-2","5.2+20240610-3","5.3+20251110-1","5.3+20251116-1","5.3+20251209-1","5.3+20251209-2","5.4-1","5.4-2","7.1-1","7.2+20261013-1","7.2+20261013-2","7.2-1","7.2-2","7.2-3"]},{"source":"osv","ecosystem":"Debian:13","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20240610-3","5.3+20251110-1","5.3+20251116-1","5.3+20251209-1","5.3+20251209-2","5.4-1","5.4-2","7.1-1","7.2+20261013-1","7.2+20261013-2","7.2-1","7.2-2","7.2-3"]},{"source":"osv","ecosystem":"Debian:14","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3+20251116-1"}]}],"versions":["5.2+20240610-3","5.3+20251110-1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-33.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-33.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-33.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP4","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2-33.oe2403sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tftp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tftp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"tftp-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-28.el8_10"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-40.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2-50.el10"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2-7ubuntu3","5.2-7ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20140608-3ubuntu1","5.2+20150808-1ubuntu1","5.2+20150808-1ubuntu1.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20150808-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20150808-1ubuntu3","5.2+20150808-1ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20150808-1.2build1","5.2+20150808-1.2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20150808-1.4","5.2+20150808-1.4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3+20251209-2","5.4-1","5.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"tftp-hpa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2+20240610-3","5.3+20251110-1","5.3+20251116-1","5.3+20251209-1","5.3+20251209-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tftp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.4-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat hardened images"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:78952","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:80663","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:82280","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98457","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:98563","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-85234","tags":["vdb-entry","x_refsource_REDHAT","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460997","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=4b493532f5ce052a1c124acd0661233ec7918327","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-85234","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rxqq-3mgh-v3m7"},{"url":"https://bugzilla.redhat.com/2460997","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-78952.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-80663.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-82280.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-85234","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4658","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4659","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4660","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4853","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_78952.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-85234","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80663.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_82280.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:78952","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:80663","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:82280","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-85234","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-85234","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-85234","title":"Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T17:58:51.667Z","modified":"2026-11-11T12:59:13.023Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T13:28:05.136075Z"}],"euvd":[{"id":"EUVD-2026-79128","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T17:58:51Z","modified":"2026-11-11T12:59:13Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T14:28:59.314266Z"}],"ghsa":[{"id":"GHSA-rxqq-3mgh-v3m7","title":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule...","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T18:32:36Z","modified":"2026-11-11T15:30:41Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T15:34:47.187237Z"}],"nvd":[{"id":"CVE-2026-85234","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T18:19:34.927Z","modified":"2026-11-11T13:17:28.387Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-11T15:25:15.031694Z"}],"osv":[{"id":"DEBIAN-CVE-2026-85234","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T18:19:34.927Z","modified":"2026-10-14T10:00:12.520299821Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:05.022702Z"},{"id":"OESA-2026-4658","title":"tftp security update","description":"TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)","status":"published","published":"2026-11-04T13:54:10Z","modified":"2026-11-04T14:00:03.051333929Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:48.853413Z"},{"id":"OESA-2026-4659","title":"tftp security update","description":"TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)","status":"published","published":"2026-11-04T13:54:11Z","modified":"2026-11-04T14:00:04.374164571Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4660","title":"tftp security update","description":"TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)","status":"published","published":"2026-11-04T13:54:11Z","modified":"2026-11-04T14:00:04.428521798Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T14:10:46.921518Z"},{"id":"OESA-2026-4853","title":"tftp security update","description":"TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP.\r\n\r\nSecurity Fix(es):\n\nA flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)","status":"published","published":"2026-11-11T12:26:51Z","modified":"2026-11-11T12:45:12.967693464Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-11T13:08:46.301371Z"},{"id":"RHSA-2026:78952","title":"Red Hat Security Advisory: tftp security update","status":"published","published":"2026-10-08T10:20:32Z","modified":"2026-10-14T10:31:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:80663","title":"Red Hat Security Advisory: tftp security update","status":"published","published":"2026-10-14T10:32:05Z","modified":"2026-10-14T10:48:13.269585061Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RHSA-2026:82280","title":"Red Hat Security Advisory: tftp security update","status":"published","published":"2026-10-14T10:32:43Z","modified":"2026-10-14T10:48:13.464735459Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.547034Z"},{"id":"RLSA-2026:78952","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.\n\nSecurity Fix(es):\n\n* tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-09T06:04:06.775914Z","modified":"2026-10-09T06:45:02.636817084Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:80663","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.\n\nSecurity Fix(es):\n\n* tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T12:04:29.039883Z","modified":"2026-10-13T12:30:03.718333719Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:82280","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.\n\nSecurity Fix(es):\n\n* tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-10-13T18:34:06.224875Z","modified":"2026-10-13T19:00:04.358453026Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-85234","description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","status":"published","published":"2026-09-15T18:19:00Z","modified":"2026-10-17T13:01:13.414329177Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:57:24.828975Z"},{"id":"ALSA-2026:78952","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.  \n\nSecurity Fix(es):  \n\n  * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-08T00:00:00Z","modified":"2026-10-29T11:02:29.72272622Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:80663","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.  \n\nSecurity Fix(es):  \n\n  * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-12T00:00:00Z","modified":"2026-10-29T11:32:38.002777596Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:82280","title":"Moderate: tftp security update","description":"The Trivial File Transfer Protocol (TFTP) is typically used only for booting diskless workstations. The tftp packages include the tftp and tftp-server subpackages. The tftp subpackage provides the user interface for TFTP and the tftp-server subpackage provides the server. This allows users to transfer files to and from a remote machine.  \n\nSecurity Fix(es):  \n\n  * tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine (CVE-2026-85234)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-10-13T00:00:00Z","modified":"2026-10-29T11:31:01.962963351Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"openSUSE-SU-2026:12412-1","title":"tftp-5.4-1.1 on GA media","description":"These are all security issues fixed in the tftp-5.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T17:23:22.336314619Z","updated_at":"2026-11-04T17:43:22.558805Z"}]}}