RHSA-2026:78952MediumCVSS 7.5

Red Hat Security Advisory: tftp security update

Published
October 8, 2026
Last Modified
October 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-85234 →

📋 Description

CVE-2026-85234 — tftp: tftp-hpa: Denial of Service due to out-of-bounds read/write in remap engine

🎯 Affected products22

  • Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-0:5.2-28.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-0:5.2-28.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-0:5.2-28.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-0:5.2-28.el8_10.src as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-0:5.2-28.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debuginfo-0:5.2-28.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debuginfo-0:5.2-28.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debuginfo-0:5.2-28.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debuginfo-0:5.2-28.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debugsource-0:5.2-28.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debugsource-0:5.2-28.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debugsource-0:5.2-28.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-debugsource-0:5.2-28.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-0:5.2-28.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-0:5.2-28.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-0:5.2-28.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-0:5.2-28.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-debuginfo-0:5.2-28.el8_10.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-debuginfo-0:5.2-28.el8_10.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-debuginfo-0:5.2-28.el8_10.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • tftp-server-debuginfo-0:5.2-28.el8_10.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: To mitigate this issue, avoid enabling filename remapping with the `m/-map-file` option for the `in.tftpd` service unless strictly necessary. If filename remapping is required, ensure that any inverse (`~`) and abort (`a`) rules in the remap file do not include a non-empty custom error message. Changes to the `in.tftpd` configuration may require restarting the service to take effect.

🔗 References (4)