← Vulnerability feed

Vulnerability record · CVE-2009-2958 · published 2 September 2009

CVE-2009-2958: Thekelleys dnsmasq vulnerability

Thekelleys · Dnsmasq

The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.

4.3 CVSS 2.0 Medium EPSS 10% · top 4.4% CWE-399 · CWE-399
4.3CVSS 2.0 base score
10%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
18References
16 Jun 2026Last modified by NVD

Description

The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.

AV:N/AC:M/Au:N/C:N/I:N/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/36563
http://www.coresecurity.com/content/dnsmasq-vulnerabilities
http://www.redhat.com/support/errata/RHSA-2009-1238.html
http://www.securityfocus.com/bid/36120
http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
http://www.ubuntu.com/usn/USN-827-1
https://bugzilla.redhat.com/show_bug.cgi?id=519020
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9816
https://rhn.redhat.com/errata/RHSA-2010-0095.html
http://secunia.com/advisories/36563
http://www.coresecurity.com/content/dnsmasq-vulnerabilities
http://www.redhat.com/support/errata/RHSA-2009-1238.html
http://www.securityfocus.com/bid/36120
http://www.thekelleys.org.uk/dnsmasq/CHANGELOG
http://www.ubuntu.com/usn/USN-827-1
https://bugzilla.redhat.com/show_bug.cgi?id=519020
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9816
https://rhn.redhat.com/errata/RHSA-2010-0095.html

Track CVE-2009-2958 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-45951Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in check_bad_address (called from check_for_bogus_wildcard and FuzzCheckForBogusWildcard). NOTE: the ve…EPSS 2.6%9.8CVE-2021-45952Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in dhcp_reply (called from dhcp_packet and FuzzDhcp). NOTE: the vendor's position is that CVE-2021-4595…EPSS 2.6%9.8CVE-2021-45953Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from hash_questions and fuzz_util.c). NOTE: the vendor's position is that CVE-2…EPSS 2.6%9.8CVE-2021-45954Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in extract_name (called from answer_auth and FuzzAuth). NOTE: the vendor's position is that CVE-2021-45…EPSS 2.6%9.8CVE-2021-45955Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in resize_packet (called from FuzzResizePacket and fuzz_rfc1035.c) because of the lack of a proper boun…EPSS 2.5%9.8CVE-2021-45956Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in print_mac (called from log_packet and dhcp_reply). NOTE: the vendor's position is that CVE-2021-4595…EPSS 2.6%9.8CVE-2021-45957Thekelleys dnsmasq out-of-bounds write vulnerabilityDnsmasq 2.86 has a heap-based buffer overflow in answer_request (called from FuzzAnswerTheRequest and fuzz_rfc1035.c). NOTE: the vendor's position is…EPSS 2.4%9.8CVE-2017-14491dnsmasq heap buffer overflow via crafted DNS responsednsmasq before 2.78 contains a heap-based buffer overflow (CWE-787 out-of-bounds write) triggered by a crafted DNS response. Because dnsmasq is widel…EPSS 85%analysed

Source: NIST National Vulnerability Database (record CVE-2009-2958), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.