{"id":"CVE-2026-127029","kind":"vulnerability","aliases":["CVE-2026-127029"],"related":[],"title":"FreeRADIUS: EAP-SIM identity overflow lets unauthenticated remote crash the server","description":"A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).","summary":"FreeRADIUS copies a client-supplied EAP-SIM identity into a fixed-size stack buffer without a length check. An unauthenticated remote attacker can send crafted EAP-SIM messages to overflow the buffer and crash the service, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["freeradius","package","radius","self-hosted","wifi-auth"],"not_affected_if":["eap-sim-disabled","not-internet-exposed"],"how_to_check":"- Run 'radiusd -v' (or 'freeradiusd -v') to get the version. Affected versions are not stated by any source I read.\n- Check whether EAP-SIM is in use: on 3.x, look for a 'sim' type in the eap module (mods-enabled/eap, 'default_eap_type' and 'eap-sim' entries) and any virtual server such as sites-enabled/eap-aka-sim. If EAP-SIM is not configured or built (rlm_eap_sim), you are likely not exposed.\n- Also check whether UDP 1812/1813 is reachable from untrusted networks.","fix":"A code fix is committed upstream (e415f81, 2026-09-16, 'make EAP-SIM independent of identity length'), but no release containing it is confirmed. Release 3.2.11 was announced 22 Oct 2026 as including TEAP and FAST fixes only; EAP-SIM is not mentioned. Until a release is confirmed, build from a source tree that includes e415f81, or disable EAP-SIM.","status":"open","published_at":"2026-11-12T17:17:42+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:39:53+00:00","updated_at":"2026-11-12T17:41:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T17:39:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FreeRADIUS: EAP-SIM identity overflow lets unauthenticated remote crash the server","impact":"low","summary":"FreeRADIUS copies a client-supplied EAP-SIM identity into a fixed-size stack buffer without a length check. An unauthenticated remote attacker can send crafted EAP-SIM messages to overflow the buffer and crash the service, causing denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freeradius","radius","wifi-auth","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Service crashes, causing denial of service on the RADIUS server","analyst_note":"Confirm affected version ranges and fixed FreeRADIUS version from the linked github.com patch commits or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127029.","how_to_check":"- Check the installed FreeRADIUS version with `radiusd -v` and compare it to the fixed versions below.\n- Check whether the EAP-SIM module is enabled in the `eap` configuration (unknown if the sources do not say which config file).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["eap-sim-disabled"],"who_is_affected":"Systems running FreeRADIUS with the EAP-SIM module enabled, which handles authentication requests from network clients such as Wi-Fi and mobile SIM-based access. The sources do not name the affected version ranges, so exposure depends on the installed version and module configuration. Servers without EAP-SIM enabled are likely not affected, though the sources do not confirm this.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00078,"input_tokens":4648,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected version ranges and fixed FreeRADIUS version from the linked github.com patch commits or the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-127029.","search":"'-127029':15A,18A '-2026':14A,17A 'attack':52B,121C 'auth':27B 'authent':80C,93C 'buffer':44B,63B,117C,137C 'caus':68B 'check':48B,109C 'client':32B,100C 'client-suppli':31B,99C 'copi':29B,97C 'craft':55B,129C 'crash':10A,65B,140C 'cve':13A,16A 'denial':69B,147C 'dos':150C 'eap':3A,35B,57B,88C,131C 'eap-sim':2A,34B,56B,87C,130C 'exploit':123C 'extens':79C 'fix':41B,115C 'fixed-s':40B,114C 'flaw':73C 'found':75C 'freeradius':1A,19B,28B,77C 'handl':92C 'host':24B 'ident':5A,37B,85C,102C 'intern':105C 'issu':125C 'length':47B,111C 'let':7A 'messag':59B,133C 'method':82C 'modul':86C,90C 'overflow':6A,61B,138C 'packag':20B 'proper':108C 'protocol':81C 'radius':21B 'remot':9A,51B,120C 'request':94C 'result':144C 'self':23B 'self-host':22B 'send':54B,127C 'server':12A,96C 'servic':67B,71B,142C,149C 'sim':4A,36B,58B,89C,132C 'size':42B,116C 'special':128C 'stack':43B,136C 'structur':106C 'subscrib':84C 'suppli':33B,101C 'trigger':134C 'unauthent':8A,50B,119C 'wifi':26B 'wifi-auth':25B 'without':45B,107C","nicknames":[],"mitigations":[],"who_affected":"FreeRADIUS servers with the EAP-SIM method enabled (usually mobile-operator Wi-Fi offload or SIM-based Wi-Fi authentication). A remote client can send an overlong EAP-SIM identity and crash the server, which cuts off authentication for everyone using it. Servers that do not use EAP-SIM, or that sit on a management VLAN unreachable by untrusted clients, can skip it. Affected version ranges are not yet published.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["freeradius","high","package","radius","selfhosted","wifiauth"],"campaign_type":null,"search_a":"'-127029':15A,18A '-2026':14A,17A 'crash':10A 'cve':13A,16A 'eap':3A 'eap-sim':2A 'freeradius':1A 'ident':5A 'let':7A 'overflow':6A 'remot':9A 'server':12A 'sim':4A 'unauthent':8A","search_b":"'attack':52B 'auth':27B 'buffer':44B,63B 'caus':68B 'check':48B 'client':32B 'client-suppli':31B 'copi':29B 'craft':55B 'crash':65B 'denial':69B 'eap':35B,57B 'eap-sim':34B,56B 'fix':41B 'fixed-s':40B 'freeradius':19B,28B 'host':24B 'ident':37B 'length':47B 'messag':59B 'overflow':61B 'packag':20B 'radius':21B 'remot':51B 'self':23B 'self-host':22B 'send':54B 'servic':67B,71B 'sim':36B,58B 'size':42B 'stack':43B 'suppli':33B 'unauthent':50B 'wifi':26B 'wifi-auth':25B 'without':45B","search_c":"'attack':121C 'authent':80C,93C 'buffer':117C,137C 'check':109C 'client':100C 'client-suppli':99C 'copi':97C 'craft':129C 'crash':140C 'denial':147C 'dos':150C 'eap':88C,131C 'eap-sim':87C,130C 'exploit':123C 'extens':79C 'fix':115C 'fixed-s':114C 'flaw':73C 'found':75C 'freeradius':77C 'handl':92C 'ident':85C,102C 'intern':105C 'issu':125C 'length':111C 'messag':133C 'method':82C 'modul':86C,90C 'overflow':138C 'proper':108C 'protocol':81C 'remot':120C 'request':94C 'result':144C 'send':127C 'server':96C 'servic':142C,149C 'sim':89C,132C 'size':116C 'special':128C 'stack':136C 'structur':106C 'subscrib':84C 'suppli':101C 'trigger':134C 'unauthent':119C 'without':107C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:42+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127029","severity":null,"published_at":"2026-11-12T17:17:42+00:00","modified_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127029:3758","url":null,"severity":null,"published_at":"2026-11-12T17:41:25+00:00","modified_at":"2026-11-12T17:41:25+00:00","first_seen_at":"2026-11-12T17:41:25+00:00","fetched_at":"2026-11-12T17:41:25+00:00","note":"Read upstream commit e415f81 (EAP-SIM identity length, reported by Glen Saunders, 2026-09-16) and the FreeRADIUS security page. Fixed release and affected range unconfirmed: NVD page has no content, security page lists only the June 2026 issues, and 3.2.11 announcement mentions only TEAP/FAST. Linked commit 064567a is EAP-FAST (probably CVE-2026-127030), not this CVE. Nothing marked verified. Revisit when 3.2.11 release notes are available."}],"documents":[{"id":136855,"url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":136856,"url":"https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}