Riskcovery

CVE-2026-85234

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

State
Published
Severity
7.5 High
Published
Sep 15, 2026
Updated
Oct 13, 2026
Reserved
Sep 3, 2026

Read the record on cve.org

Description

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat

Weaknesses

Affected Products

ProductVersions
Red Hat Enterprise Linux 10Red Hat
  • 0:5.2-50.el10_2 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:5.2-28.el8_10 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:5.2-40.el9_8.1 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
    Red Hat Enterprise Linux 7Red Hat
      Red Hat Hardened ImagesRed Hat

        References

        Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.