FreeRADIUS: EAP-FAST module stack-based buffer overflow (CVE-2026-127030)
FreeRADIUS contains a stack-based buffer overflow vulnerability in its EAP-FAST module that allows remote, unauthenticated attackers to cause a denial-of-service (DoS) via crafted handshake requests.
CVE search metadata
CVE search record: CVE-2026-127030. Severity: high. CVSS: 7.5. KEV: no. Product: FreeRADIUS. Brief: FreeRADIUS: EAP-FAST module stack-based buffer overflow (CVE-2026-127030). Brief link: https://feed.craftedsignal.io/briefs/2026-11-freeradius-buffer-overflow-cve-2026-127030/
Triage facts
Revision 1- Applicability
- FreeRADIUS
- Evidence
- Unknown
- Severity
- Low
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:45 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
A vulnerability (CVE-2026-127030) exists in FreeRADIUS within the EAP-FAST module. Improper length validation during the processing of session tickets leads to a stack-based buffer overflow. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted handshake request, which causes the FreeRADIUS server process to crash.
Impact
Exploitation of this vulnerability results in a denial-of-service (DoS) condition, as the server process crashes upon receipt of the malicious request. The CVSS v3.1 base score is 7.5.
Recommendation
Administrators should monitor vendor updates and apply patches for FreeRADIUS as they become available to remediate the EAP-FAST length validation flaw. Given the potential for service disruption, ensure that FreeRADIUS instances are not exposed to untrusted networks where external actors can initiate EAP-FAST handshake requests.
Immediate actions
Audit current FreeRADIUS deployments and verify whether the EAP-FAST module is enabled or required.
Threat Hunt
Monitor server logs for unexpected process crashes or restarts of the FreeRADIUS service, which may indicate crash-based exploitation attempts.
Data: System/Service logs, Process monitoring telemetry
Mitigations
Disable EAP-FAST module if not strictly required to mitigate the attack vector until patches are applied.
CVE-2026-127030