OESA-2026-4659

    Dashboard / Vulnerabilities / OESA-2026-4659

    OESA-2026-4659

    Published: 4 Nov 2026Last Modified: 4 Nov 2026
    Upstream:
    CVE-2026-85234

    Summary: tftp security update

    Details: TFTP which is the abbreviation of Trivial File Fransfer Protocol enables users to transfer files between local host and remote machine. This package tftp is a client implementing TFTP. Security Fix(es): A flaw was found in tftp-hpa. When the `in.tftpd` remap engine processes an inverse remap rule that also aborts with a non-empty custom error message, it can pass invalid match offsets to the `genmatchstring()` function. This leads to out-of-bounds read/write operations. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted request, causing the daemon to crash and resulting in a denial of service.(CVE-2026-85234)

    References: https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4659, https://nvd.nist.gov/vuln/detail/CVE-2026-85234

    Affected packages

    Package

    Name: tftp

    Purl: pkg:rpm/openEuler/tftp&distro=openEuler-24.03-LTS-SP1

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -5.2-33.oe2403sp1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    OESA-2026-4659 | CVE-DB