CVE-2026-106026 in tftp-hpa
Summary
by MITRE • 10/06/2026
tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in tftp-hpa versions prior to 6.0 represents a critical security flaw within the Trivial File Transfer Protocol daemon, specifically located in the rewrite_string function found in the tftpd/remap.c source file. This component is responsible for processing filename remapping rules, which allow administrators to redirect client requests to different locations on the server filesystem based on predefined patterns. The core technical deficiency lies in how the software handles jump label searches during this remapping process. When a remote attacker submits a read or write request with a filename that matches a specific remap jump rule, the application fails to properly validate memory boundaries before accessing data structures associated with these labels. This oversight results in an out-of-bounds read operation where the program attempts to access heap memory locations that are outside the allocated and valid range for the current context.
From a technical perspective, this flaw is classified as CWE-125, which denotes Out-of-Bounds Read. The vulnerability exploits the lack of rigorous bounds checking when iterating through or accessing elements within the jump label data structures during the remapping logic execution. Because tftpd typically operates by forking a new process to handle each incoming connection request, this memory access violation occurs within an isolated child process rather than affecting the main daemon directly. However, the consequence is severe as it leads to immediate termination of the forked in.tftpd handler due to segmentation faults or similar fatal errors triggered by illegal memory access. This behavior effectively allows unauthenticated remote attackers to trigger a denial-of-service condition against the TFTP service without requiring any form of authentication credentials.
The operational impact of this vulnerability is primarily centered on availability rather than confidentiality or integrity, although the potential for further exploitation cannot be entirely dismissed depending on the specific heap layout and memory corruption patterns that might arise from repeated crashes. An attacker can send crafted packets containing maliciously formatted filenames to repeatedly crash individual request handlers. While a single crash may only disrupt one file transfer session, an automated attack could exhaust system resources or cause significant service degradation for legitimate users relying on TFTP for network booting, firmware updates, or configuration backups. The vulnerability is particularly dangerous because it requires no prior authentication, making it accessible to any host with network connectivity to the vulnerable server port.
In terms of threat modeling and industry standards, this incident aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or service disruption through application crashes. The attack vector is classified as Network-based (ATT&CK T1078) since it leverages standard network protocols and does not require local access to the target system. Security analysts should note that while the immediate effect is a crash, improper memory handling in C/C++ applications can sometimes lead to information disclosure if the out-of-bounds read retrieves sensitive data from adjacent heap regions before the process terminates.
To mitigate this risk, organizations running tftp-hpa must upgrade immediately to version 6.0 or later, where the developers have addressed the bounds checking issues within the rewrite_string function and related remapping logic. Until an update can be applied, network-level controls such as firewall rules should restrict access to UDP port 69 (or the configured TFTP port) to only trusted IP addresses known to require TFTP services. Additionally, deploying intrusion detection systems with signatures capable of identifying anomalous filename patterns or excessive connection attempts from single sources may help mitigate the frequency of exploitation attempts. Regular patch management and vulnerability scanning are essential practices to ensure that such legacy software components do not remain exposed in production environments where they pose a tangible risk to service availability.