Moderate Vulnerability in TFTP and TFTP-Server Packages: Denial of Service Risk
Summary
ALSA-2026:80663: Moderate: tftp security update. Affects tftp versions < 5.2-40.el9_8.1. Fixed in 5.2-40.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Trivial File Transfer Protocol (TFTP) is a simple protocol used primarily for transferring files, often in environments where minimal overhead is desired, such as booting diskless workstations. The TFTP package includes two main components: the 'tftp' client, which provides the user interface, and the 'tftp-server', which allows for file transfers to and from a remote machine. This protocol is lightweight but can be susceptible to security vulnerabilities, particularly in its handling of data.
Vulnerability Detail
The vulnerability identified as CVE-2026-85234 pertains to a Denial of Service (DoS) condition caused by an out-of-bounds read/write in the remap engine of the tftp-hpa implementation. This flaw can allow an attacker to exploit the TFTP service, potentially leading to service interruptions and making the system unresponsive to legitimate requests. The vulnerability arises from improper handling of data, which can be triggered by maliciously crafted requests.
How To Fix
Minimum fixed version
5.2-40.el9_8.1
This is the first release that contains the fix.
sudo dnf update tftpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the TFTP service until the package is updated. This can be done by executing the command:
sudo systemctl stop tftp.service' and 'sudo systemctl disable tftp.service'.
Conclusion
The TFTP and TFTP-Server packages have a moderate vulnerability that can lead to Denial of Service due to an out-of-bounds error. It is crucial for users to update their packages to the latest patched version to ensure system security. Temporary workarounds are available, but the best course of action is to apply the necessary updates.
See every vulnerability recorded for tftp →
FAQ
TFTP stands for Trivial File Transfer Protocol, a simple protocol used for transferring files, often in network booting scenarios.
CVE-2026-85234 refers to a specific vulnerability in the TFTP service that can lead to Denial of Service due to an out-of-bounds read/write error.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider disabling the TFTP service as a temporary workaround to mitigate the risk.
For more details, refer to the CVE page associated with CVE-2026-85234, which provides in-depth information about the vulnerability and its impact.
Related vulnerabilities
Recent vulnerabilities recorded for tftp.
