FreeRADIUS - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/freeradius/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 18:45:41 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFreeRADIUS: EAP-FAST module stack-based buffer overflow (CVE-2026-127030)https://feed.craftedsignal.io/briefs/2026-11-freeradius-buffer-overflow-cve-2026-127030/Thu, 12 Nov 2026 18:45:41 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-freeradius-buffer-overflow-cve-2026-127030/FreeRADIUS contains a stack-based buffer overflow vulnerability in its EAP-FAST module that allows remote, unauthenticated attackers to cause a denial-of-service (DoS) via crafted handshake requests.A vulnerability (CVE-2026-127030) exists in FreeRADIUS within the EAP-FAST module. Improper length validation during the processing of session tickets leads to a stack-based buffer overflow. An unauthenticated remote attacker can exploit this flaw by sending a specially crafted handshake request, which causes the FreeRADIUS server process to crash.

Impact

Exploitation of this vulnerability results in a denial-of-service (DoS) condition, as the server process crashes upon receipt of the malicious request. The CVSS v3.1 base score is 7.5.

Recommendation

Administrators should monitor vendor updates and apply patches for FreeRADIUS as they become available to remediate the EAP-FAST length validation flaw. Given the potential for service disruption, ensure that FreeRADIUS instances are not exposed to untrusted networks where external actors can initiate EAP-FAST handshake requests.

]]>lowadvisoryFreeRADIUS: EAP-SIM module stack buffer overflow (CVE-2026-127029)https://feed.craftedsignal.io/briefs/2026-11-freeradius-eap-sim-buffer-overflow-cve-2026-127029/Thu, 12 Nov 2026 18:45:32 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-freeradius-eap-sim-buffer-overflow-cve-2026-127029/FreeRADIUS contains a stack buffer overflow vulnerability in its EAP-SIM module, allowing an unauthenticated remote attacker to cause a Denial of Service (DoS) by sending crafted authentication requests.A buffer overflow vulnerability exists in the FreeRADIUS Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. The issue arises when the server processes authentication requests and fails to validate the length of a client-supplied identity string before copying it into a fixed-size internal buffer. An unauthenticated attacker can exploit this flaw to crash the FreeRADIUS service.

Impact

Successful exploitation results in a Denial of Service (DoS) of the FreeRADIUS service. The vulnerability carries a CVSS v3.1 base score of 7.5.

Recommendation

  • Identify all instances of FreeRADIUS within the environment.
  • Monitor vendor security advisories for the release of a patched version of FreeRADIUS.
  • Implement network-level rate limiting or authentication inspection to identify anomalous EAP-SIM traffic patterns directed at the RADIUS server.
]]>lowadvisory