Threat database

tftp-hpa versions 5.4 up to but not including 6.0 contain an out-of-bounds read vulnerability in the rewrite_string() function within tftpd/remap.c. This flaw occurs during heap memory traversal for jump label searches. An unauthenticated remote attacker can exploit this by sending read or write requests with filenames matching a remap jump rule, causing the forked in.tftpd request handler to crash.