A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade tftp-serverUpgrade tftp | Oct 11, 2026 | Oct 8, 2026 |
| Redhat_linux | — | Upgrade tftp-debugsourceUpgrade tftp-server-debuginfoUpgrade tftp-debuginfoUpgrade tftp-serverNo solution existsUpgrade tftp | Sep 17, 2026 | Sep 15, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub