CVE-2009-2958: Thekelleys Dnsmasq

Medium severity, CVSS 4.3. EPSS: 10.4% chance of exploitation in the next 30 days.

The tftp_request function in tftp.c in dnsmasq before 2.50, when --enable-tftp is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a TFTP read (aka RRQ) request with a malformed blksize option.

Affected products

• Thekelleys Dnsmasq: up to and including 2.49; version 0.4 only; version 0.5 only; version 0.6 only; version 0.7 only; version 0.95 only; …

Published 2009-09-02. Last modified 2026-06-16.