CVE-2009-2957: Thekelleys Dnsmasq

Medium severity, CVSS 6.8. EPSS: 12.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in the tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, might allow remote attackers to execute arbitrary code via a long filename in a TFTP packet, as demonstrated by a read (aka RRQ) request.

Affected products

• Thekelleys Dnsmasq: up to and including 2.49; version 0.4 only; version 0.5 only; version 0.6 only; version 0.7 only; version 0.95 only; …

Published 2009-09-02. Last modified 2026-06-16.