{"affected":[{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"tftp","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.2-50.el10_2","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"tftp","product":"Red Hat Enterprise Linux 8","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.2-28.el8_10","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"tftp","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"0:5.2-40.el9_8.1","versionType":"rpm"}]},{"defaultStatus":"unknown","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"tftp","product":"Red Hat Enterprise Linux 6","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"tftp","product":"Red Hat Enterprise Linux 7","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"erlang27","product":"Red Hat Hardened Images","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2026-85234","cwes":["CWE-125"],"description":"A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.","epss":{"date":"2026-11-05","percentile":0.40783,"score":0.0047},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793927277736,"publishedAt":1789495131667,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:78952"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:80663"},{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2026:82280"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2026-85234"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2460997"},{"source":"CNA: redhat","tags":[],"url":"https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=4b493532f5ce052a1c124acd0661233ec7918327"}],"remediation":[{"kind":"workaround","source":"CNA: redhat","text":"To mitigate this issue, avoid enabling filename remapping with the `m/-map-file` option for the `in.tftpd` service unless strictly necessary. If filename remapping is required, ensure that any inverse (`~`) and abort (`a`) rules in the remap file do not include a non-empty custom error message. Changes to the `in.tftpd` configuration may require restarting the service to take effect."}],"revision":"459984077d78bc86a53ec1121eba8b801f76286142ca9990f5549255886802aa","sources":[{"modifiedAt":1793927277736,"name":"CNA: redhat","retrievedAt":1793931005470,"url":"https://www.cve.org/CVERecord?id=CVE-2026-85234"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793931024776,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-85234"}],"ssvc":{"assessedAt":1789499231649,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine","updatedAt":1793931024776}