{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/freeradius/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-127030"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeRADIUS"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FreeRADIUS"],"content_html":"\u003cp\u003eA vulnerability (CVE-2026-127030) exists in FreeRADIUS within the EAP-FAST module. Improper length validation during the processing of session tickets leads to a stack-based buffer overflow. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted handshake request, which causes the FreeRADIUS server process to crash.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eExploitation of this vulnerability results in a denial-of-service (DoS) condition, as the server process crashes upon receipt of the malicious request. The CVSS v3.1 base score is 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eAdministrators should monitor vendor updates and apply patches for FreeRADIUS as they become available to remediate the EAP-FAST length validation flaw. Given the potential for service disruption, ensure that FreeRADIUS instances are not exposed to untrusted networks where external actors can initiate EAP-FAST handshake requests.\u003c/p\u003e\n","date_modified":"2026-11-12T18:45:41Z","date_published":"2026-11-12T18:45:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-freeradius-buffer-overflow-cve-2026-127030/","summary":"FreeRADIUS contains a stack-based buffer overflow vulnerability in its EAP-FAST module that allows remote, unauthenticated attackers to cause a denial-of-service (DoS) via crafted handshake requests.","title":"FreeRADIUS: EAP-FAST module stack-based buffer overflow (CVE-2026-127030)","url":"https://feed.craftedsignal.io/briefs/2026-11-freeradius-buffer-overflow-cve-2026-127030/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:freeradius:freeradius:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-127029"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FreeRADIUS"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["FreeRADIUS"],"content_html":"\u003cp\u003eA buffer overflow vulnerability exists in the FreeRADIUS Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. The issue arises when the server processes authentication requests and fails to validate the length of a client-supplied identity string before copying it into a fixed-size internal buffer. An unauthenticated attacker can exploit this flaw to crash the FreeRADIUS service.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a Denial of Service (DoS) of the FreeRADIUS service. The vulnerability carries a CVSS v3.1 base score of 7.5.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of FreeRADIUS within the environment.\u003c/li\u003e\n\u003cli\u003eMonitor vendor security advisories for the release of a patched version of FreeRADIUS.\u003c/li\u003e\n\u003cli\u003eImplement network-level rate limiting or authentication inspection to identify anomalous EAP-SIM traffic patterns directed at the RADIUS server.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-12T18:45:32Z","date_published":"2026-11-12T18:45:32Z","id":"https://feed.craftedsignal.io/briefs/2026-11-freeradius-eap-sim-buffer-overflow-cve-2026-127029/","summary":"FreeRADIUS contains a stack buffer overflow vulnerability in its EAP-SIM module, allowing an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending crafted authentication requests.","title":"FreeRADIUS: EAP-SIM module stack buffer overflow (CVE-2026-127029)","url":"https://feed.craftedsignal.io/briefs/2026-11-freeradius-eap-sim-buffer-overflow-cve-2026-127029/"}],"language":"en","title":"CraftedSignal Threat Feed - FreeRADIUS","version":"https://jsonfeed.org/version/1.1"}