Skip to content
Fencer Vulns
high 7.5

CVE-2026-85234 json

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

published 2026-09-15 54 d ago modified 2026-11-06 3 d ago also EUVD-2026-79128

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:5.2-50.el10_2
  • Red Hat Red Hat Enterprise Linux 8 0:5.2-28.el8_10
  • Red Hat Red Hat Enterprise Linux 9 0:5.2-40.el9_8.1
  • tftp-hpa Debian 14 5.3+20251116-1

debian advisories DEBIAN-CVE-2026-85234

  • tftp RHEL 10.2 5.2-50.el10_2
  • tftp-server RHEL 10.2 5.2-50.el10_2
  • tftp RHEL 9 5.2-40.el9_8.1
  • tftp-server RHEL 9 5.2-40.el9_8.1
  • tftp RHEL 8 5.2-28.el8_10
  • tftp-server RHEL 8 5.2-28.el8_10

red hat advisories RHSA-2026:82280RHSA-2026:80663RHSA-2026:78952

  • tftp openSUSE Tumbleweed 5.4-1.1

opensuse advisories openSUSE-SU-2026:12412-1

  • tftp AlmaLinux 10 5.2-50.el10_2
  • tftp-server AlmaLinux 10 5.2-50.el10_2
  • tftp AlmaLinux 9 5.2-40.el9_8.1
  • tftp-server AlmaLinux 9 5.2-40.el9_8.1
  • tftp AlmaLinux 8 5.2-28.el8_10
  • tftp-server AlmaLinux 8 5.2-28.el8_10

almalinux advisories ALSA-2026:82280ALSA-2026:80663ALSA-2026:78952

  • tftp Rocky Linux 10 5.2-50.el10
  • tftp Rocky Linux 9 5.2-40.el9_8.1
  • tftp Rocky Linux 8 5.2-28.el8_10

rocky linux advisories RLSA-2026:82280RLSA-2026:80663RLSA-2026:78952

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-85234 updated cvss 7.5

tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine

  • Red Hat Enterprise Linux 6 tftp, tftp-server
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 tftp, tftp-server
    affected: workaround, no fix available
  • Red Hat Enterprise Linux AppStream (v. 8) tftp 5.2-28.el8_10, tftp-server 5.2-28.el8_10
    fixed: vendor fix RHSA-2026:78952
  • Red Hat Enterprise Linux AppStream (v. 9) tftp 5.2-40.el9_8.1, tftp-server 5.2-40.el9_8.1
    fixed: vendor fix RHSA-2026:80663
  • Red Hat Enterprise Linux AppStream (v. 10) tftp 5.2-50.el10_2, tftp-server 5.2-50.el10_2
    fixed: vendor fix RHSA-2026:82280
  • Red Hat Hardened Images erlang27
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
54 d ago

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Hardened Images

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.