CVE-2026-106026 Overview
CVE-2026-106026 is an out-of-bounds read vulnerability in tftp-hpa versions 5.4 before 6.0. The flaw resides in the rewrite_string() function in tftpd/remap.c, which walks heap memory during jump label searches. An unauthenticated remote attacker can send a Trivial File Transfer Protocol (TFTP) read or write request whose filename matches a remap jump rule. The malformed request causes the forked in.tftpd request handler to crash, resulting in a denial of service against the TFTP service. The weakness is classified as [CWE-125] Out-of-bounds Read.
Critical Impact
Unauthenticated remote attackers can crash the in.tftpd request handler by sending a crafted filename that matches a configured remap jump rule.
Affected Products
- tftp-hpa version 5.4
- tftp-hpa versions after 5.4 and before 6.0
- Linux distributions packaging vulnerable tftp-hpa builds with remap rules enabled
Discovery Timeline
- 2026-10-06 - CVE-2026-106026 published to the National Vulnerability Database (NVD)
- 2026-10-06 - Last updated in the NVD database
Technical Details for CVE-2026-106026
Vulnerability Analysis
The vulnerability affects the TFTP server component (in.tftpd) shipped with tftp-hpa. The server supports a filename remap feature configured via a rewrite rules file. When a client sends a read request (RRQ) or write request (WRQ), the daemon forks a handler process that passes the requested filename through rewrite_string() in tftpd/remap.c. During rule processing, the function supports jump labels that allow one rule to transfer control to another. The jump label search routine walks heap memory beyond the intended buffer boundary, producing an out-of-bounds read. The read triggers a crash in the forked handler, terminating the request without affecting the parent listener but denying service to that transfer.
Root Cause
The root cause is missing boundary enforcement in the jump label lookup logic inside rewrite_string(). The function iterates over rule structures in search of a matching label, but it does not verify that iteration stops within the allocated rule list. When a filename matches a remap rule that invokes a jump, the search dereferences memory outside the valid heap allocation, violating safe memory access assumptions.
Attack Vector
Exploitation requires network access to UDP port 69 on a vulnerable in.tftpd instance that has remap rules configured with jump directives. The attacker sends an unauthenticated TFTP RRQ or WRQ packet containing a filename designed to match a remap jump rule. No credentials, user interaction, or privileged position are required. The impact is limited to availability of the TFTP service; confidentiality and integrity are not affected per the CVSS vector. Deployments without a remap rules file, or without jump directives in that file, are not exposed.
No verified public proof-of-concept code is available. See the VulnCheck Security Advisory and the upstream TFTP-HPA Commit Details for technical specifics.
Detection Methods for CVE-2026-106026
Indicators of Compromise
- Repeated segmentation fault entries for in.tftpd child processes in /var/log/messages, journalctl, or dmesg output.
- TFTP server log entries showing incoming RRQ or WRQ requests with unusual filenames followed by abrupt session termination.
- Core dumps generated by in.tftpd referencing rewrite_string or tftpd/remap.c frames.
Detection Strategies
- Monitor process-exit telemetry for in.tftpd crashes correlated with inbound UDP/69 traffic.
- Inspect active remap configuration files for rules containing jump directives, since only those deployments are exploitable.
- Capture packet traces on UDP/69 and alert on TFTP opcode 1 (RRQ) or 2 (WRQ) packets with filenames that match remap jump labels in use.
Monitoring Recommendations
- Forward syslog and auditd records from TFTP servers to a central analytics platform for pattern correlation.
- Alert on bursts of short-lived in.tftpd child processes exiting with non-zero status within short time windows.
- Baseline normal TFTP client source addresses and flag unexpected sources sending RRQ or WRQ requests.
How to Mitigate CVE-2026-106026
Immediate Actions Required
- Upgrade tftp-hpa to version 6.0 or later as soon as a distribution package is available.
- Restrict inbound UDP/69 access to known TFTP client subnets using host or network firewalls.
- Audit any remap rules file in use and remove jump directives if they are not required for operations.
Patch Information
Upstream fixed the issue in tftp-hpa 6.0. The relevant source change is published in the TFTP-HPA Commit Details. The vulnerable code path remains visible in the TFTP-HPA Source Code for the 5.4 branch. Monitor your Linux distribution's security advisory channel for a backported package and apply it through standard package management.
Workarounds
- Disable the remap feature by starting in.tftpd without the -m <rulesfile> option until the patch is applied.
- Remove jump directives from the remap rules file, since only jump processing triggers the out-of-bounds read.
- Stop and disable the TFTP service on hosts that do not require it, using systemctl disable --now tftp.socket tftp.service.
# Configuration example: disable the remap option in the systemd unit
# Edit the TFTP service drop-in
sudo systemctl edit tftp.service
# Replace the ExecStart line so that the -m <rulesfile> flag is removed:
# [Service]
# ExecStart=
# ExecStart=/usr/sbin/in.tftpd --foreground --address :::69 --secure /srv/tftp
sudo systemctl daemon-reload
sudo systemctl restart tftp.service
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
