CVE-2026-106026

Name of the Vulnerable Software and Affected Versions tftp-hpa versions 5.4 through 5.9

Description An out-of-bounds read occurs in the rewrite string() function within tftpd/remap.c during jump label searches, causing the process to walk heap memory. Unauthenticated remote attackers can trigger this by sending read or write requests with a filename that matches a remap jump rule, leading to a crash of the forked in.tftpd request handler.

Recommendations Update tftp-hpa to version 6.0.