Executive brief
tftp-hpa is a TFTP (Trivial File Transfer Protocol) server daemon used for booting diskless machines and serving files over the network. A flaw in the remap engine can cause the daemon to crash when processing specially crafted requests, resulting in service unavailability. This vulnerability requires non-default configuration (filename remapping enabled), limiting broad exposure but affecting deployments that rely on remapping features.
Technical details
The vulnerability is an out-of-bounds read/write (CWE-125) in the in.tftpd remap engine. When processing inverse remap rules (using the ~ operator) combined with abort rules (using the a operator) that include a non-empty custom error message, invalid match offsets are passed to the genmatchstring() function, triggering out-of-bounds memory access. A remote, unauthenticated attacker can exploit this via a specially crafted TFTP request without authentication or user interaction required. The attack causes a denial of service by crashing the daemon. The vulnerability is only exposed when the m/-map-file option is enabled with specific rule configurations, and a patch is available in the tftp-hpa Git repository.
Affected products
- tftp-hpa tftp-hpa <UNKNOWN>
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fix available in Git repository (commit 4b493532f5ce052a1c124acd0661233ec7918327)