Moderate Vulnerability in TFTP and TFTP-Server Packages: Denial of Service Risk
Summary
ALSA-2026:78952: Moderate: tftp security update. Affects tftp versions < 5.2-28.el8_10. Fixed in 5.2-28.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Trivial File Transfer Protocol (TFTP) is a simple protocol used primarily for transferring files, often in environments where minimal overhead is desired, such as booting diskless workstations. The TFTP packages include two main components: 'tftp', which provides the user interface, and 'tftp-server', which serves files to clients. This vulnerability affects both packages, allowing for potential exploitation.
Vulnerability Detail
The vulnerability identified as CVE-2026-85234 involves a Denial of Service (DoS) condition caused by an out-of-bounds read/write in the remap engine of the tftp-hpa implementation. This flaw can be exploited by an attacker to crash the TFTP server, leading to service interruptions and potential data loss. The issue arises from improper handling of input, which can be manipulated to trigger the vulnerability.
How To Fix
Minimum fixed version
5.2-28.el8_10
This is the first release that contains the fix.
sudo dnf update tftpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the TFTP server by implementing firewall rules to limit incoming connections. This can help mitigate the risk of exploitation until the packages are updated. For example, using iptables, you could run:
sudo iptables -A INPUT -p udp --dport 69 -s <trusted_ip> -j ACCEPT
sudo iptables -A INPUT -p udp --dport 69 -j DROP
Replace <trusted_ip> with the IP address of trusted clients.
Conclusion
The vulnerability in the TFTP and TFTP-Server packages poses a moderate risk due to the potential for Denial of Service attacks. Users are encouraged to update their packages to the latest versions to ensure security. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for tftp →
FAQ
TFTP stands for Trivial File Transfer Protocol, a simple protocol used for transferring files, often in network booting scenarios.
CVE-2026-85234 refers to a specific vulnerability in the TFTP implementation that can lead to a Denial of Service condition.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Exploitation of this vulnerability can lead to service interruptions, causing the TFTP server to crash and potentially resulting in data loss.
It is recommended to regularly check for updates and apply them promptly to mitigate security risks.
Related vulnerabilities
Recent vulnerabilities recorded for tftp.
