PT-2026-106729

Name of the Vulnerable Software and Affected Versions tftp-hpa versions 5.4 through 5.9 Description An out-of-bounds read occurs in the rewrite string function within tftpd/remap.c during jump label searches, causing the process to walk heap memory. Unauthenticated remote attackers can trigger th...

CentOS Linux 6 [TuxCare] Security Update: curl / libcurl / libcurl-devel (CENTOS6:CLSA-2026:1778223262)

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1778223262 advisory. - Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3. CVE-2019-5482 Note that Nessus has not tested for this issue but ha...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102721

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102721

The NetX Duo TFTP client is vulnerable to a heap-buffer-overflow in the nxd_tftp_client.c component. When a remote TFTP server returns an ERROR packet lacking a terminating NUL byte, the client fails to verify the buffer_ptr against the nx_packet_append_ptr during message copying. This causes the...

EUVD-2026-89185

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

EUVD-2026-89176

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102713

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

CVE-2026-102713

The NetX Duo TFTP server is vulnerable to a heap-buffer overflow and a denial-of-service condition due to a missing upper-bound check on incoming DATA datagrams . Because the server fails to validate that nx_packet_length is within the protocol maximum of 4 + NX_TFTP_FILE_TRANSFER_MAX, it allows ...

PT-2026-102768

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A heap-buffer-overflow occurs when a TFTP server responds with a short ERROR packet. The client only verifies that the datagram is at least four bytes long, but...

PT-2026-102761

Name of the Vulnerable Software and Affected Versions NetX Duo TFTP server affected versions not specified Description The TFTP server fails to validate the upper bound of DATA datagram sizes, ignoring the protocol maximum of 4 + NX TFTP FILE TRANSFER MAX. This lack of validation leads to two...

CVE-2026-102721: Out-of-bounds Read

A TFTP server that answers with a short ERROR packet makes the client read up to 64 bytes past the received datagram. Each receive path checks only that the datagram is at least four bytes long nxdtftpclient.c:1229, 1521, 1984. When the opcode is NXTFTPCODEERROR the message string is copied with ...

CVE-2026-102713: Out-of-bounds Read

The TFTP server accepts a DATA datagram of any size. The dispatcher rejects datagrams shorter than four bytes nxdtftpserver.c:1037 and nothing anywhere checks an upper bound, in particular not against the protocol maximum of 4 + NXTFTPFILETRANSFERMAX. Two things follow from that one missing check...

SUSE CVE-2026-95508

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...

AZL-103472 CVE-2026-95508 affecting package libslirp 4.9.3-1

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting ...