CVE-2026-106026

Low

Description

tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump label searches. Unauthenticated remote attackers can send read or write requests whose filename matches a remap jump rule to crash the forked in.tftpd request handler.

SeverityLow

CVSS3.7

Exploit probability—

ProductH. Peter Anvin Tftp-hpa

PublishedOct 6, 2026

First seenOct 6, 2026

Weakness typeCWE-125Out-of-bounds read

How to fix

Update

H. Peter Anvin tftp-hpa6.0 or later

Patches

git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291

Affected products

Product	Affected versions	Fixed in
H. Peter Anvin tftp-hpa	5.4 ≤ v < 6.0	6.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.