Tftp Hpa
Monthly
An out-of-bounds heap read in tftp-hpa's rewrite_string() function (tftpd/remap.c) lets an unauthenticated remote attacker send a TFTP read or write request whose filename matches a configured remap 'jump' rule, causing the forked in.tftpd request handler to read past the end of a heap buffer and crash. Only tftp-hpa 5.4 through versions before 6.0 are affected, and exploitation is not possible in a default deployment: the daemon must be started with the remap feature enabled (the tftpd '-m'/mapfile option) and the rule set must contain at least one jump rule. The vendor-supplied CVSS 4.0 vector scores this 6.3 (medium), but the impact is limited to a low availability effect - the crashed process is the per-request child, not the listening daemon, so the practical result is aborted individual transfers rather than full service loss; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
An out-of-bounds heap read in tftp-hpa's rewrite_string() function (tftpd/remap.c) lets an unauthenticated remote attacker send a TFTP read or write request whose filename matches a configured remap 'jump' rule, causing the forked in.tftpd request handler to read past the end of a heap buffer and crash. Only tftp-hpa 5.4 through versions before 6.0 are affected, and exploitation is not possible in a default deployment: the daemon must be started with the remap feature enabled (the tftpd '-m'/mapfile option) and the rule set must contain at least one jump rule. The vendor-supplied CVSS 4.0 vector scores this 6.3 (medium), but the impact is limited to a low availability effect - the crashed process is the per-request child, not the listening daemon, so the practical result is aborted individual transfers rather than full service loss; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).