Moderate Vulnerability in TFTP and TFTP-Server Packages: Denial of Service Risk
Summary
ALSA-2026:82280: Moderate: tftp security update. Affects tftp versions < 5.2-50.el10_2. Fixed in 5.2-50.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Trivial File Transfer Protocol (TFTP) is a simple protocol used primarily for transferring files, often in environments where minimal overhead is desired, such as booting diskless workstations. The TFTP package includes both a client interface and a server component, allowing users to upload and download files from remote machines. However, due to its simplicity, TFTP can be susceptible to various security vulnerabilities, including denial of service attacks.
Vulnerability Detail
The vulnerability identified as CVE-2026-85234 affects the tftp-hpa implementation of TFTP. It arises from an out-of-bounds read/write issue in the remap engine, which can lead to a denial of service condition. This means that an attacker could exploit this vulnerability to crash the TFTP server, making it unavailable for legitimate users. The potential impact includes service disruption and loss of file transfer capabilities, which can be critical in environments relying on TFTP for booting or file management.
How To Fix
Minimum fixed version
5.2-50.el10_2
This is the first release that contains the fix.
sudo dnf update tftpTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the packages, consider disabling the TFTP service until the update can be applied. This can be done using the following command:
sudo systemctl stop tftp.service
Additionally, you may want to restrict access to the TFTP server by configuring firewall rules to limit connections to trusted IP addresses only.
Conclusion
In summary, the TFTP and TFTP-server packages have a moderate vulnerability that can lead to denial of service. It is crucial to update to the patched version to ensure the security and availability of your file transfer services. If immediate updates are not feasible, consider implementing workarounds to mitigate risks.
See every vulnerability recorded for tftp →
FAQ
TFTP stands for Trivial File Transfer Protocol, a simple protocol used for transferring files, often in network booting scenarios.
CVE-2026-85234 refers to a specific vulnerability in the TFTP implementation that can lead to a denial of service due to an out-of-bounds read/write error.
You can use Vulert, which monitors open-source vulnerabilities in software using a manifest file. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The main impact is a denial of service, which can disrupt file transfers and make the TFTP service unavailable to legitimate users.
Yes, you can disable the TFTP service temporarily and restrict access through firewall rules until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for tftp.
