CVE-2020-6097: Atftp Project Atftp

High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days.

An exploitable denial of service vulnerability exists in the atftpd daemon functionality of atftp 0.7.git20120829-3.1+b1. A specially crafted sequence of RRQ-Multicast requests trigger an assert() call resulting in denial-of-service. An attacker can send a sequence of malicious packets to trigger this vulnerability.

Affected products

• Atftp Project Atftp: version 0.7.git20120829-3.1+b1 only
• Debian Debian Linux: version 9.0 only
• Opensuse Leap: version 15.2 only

Published 2020-09-10. Last modified 2026-06-17.