---
id: "CVE-2026-127029"
page: "https://infrastack.ai/live/CVE-2026-127029"
kind: "vulnerability"
aliases: ["CVE-2026-127029"]
title: "FreeRADIUS: EAP-SIM identity overflow lets unauthenticated remote crash the server"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["freeradius", "package", "radius", "self-hosted", "wifi-auth"]
not_affected_if: ["eap-sim-disabled", "not-internet-exposed"]
published_at: "2026-11-12T17:17:42+00:00"
first_seen_at: "2026-11-12T17:39:39+00:00"
updated_at: "2026-11-12T17:41:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-127029", "first_seen_at": "2026-11-12T17:39:39+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-12T17:41:25+00:00"}]
exploit_sources: []
---

# FreeRADIUS: EAP-SIM identity overflow lets unauthenticated remote crash the server

Link for people: https://infrastack.ai/live/CVE-2026-127029 (this .md is for agents)

FreeRADIUS copies a client-supplied EAP-SIM identity into a fixed-size stack buffer without a length check. An unauthenticated remote attacker can send crafted EAP-SIM messages to overflow the buffer and crash the service, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run 'radiusd -v' (or 'freeradiusd -v') to get the version. Affected versions are not stated by any source I read.
- Check whether EAP-SIM is in use: on 3.x, look for a 'sim' type in the eap module (mods-enabled/eap, 'default_eap_type' and 'eap-sim' entries) and any virtual server such as sites-enabled/eap-aka-sim. If EAP-SIM is not configured or built (rlm_eap_sim), you are likely not exposed.
- Also check whether UDP 1812/1813 is reachable from untrusted networks.

## Fix

A code fix is committed upstream (e415f81, 2026-09-16, 'make EAP-SIM independent of identity length'), but no release containing it is confirmed. Release 3.2.11 was announced 22 Oct 2026 as including TEAP and FAST fixes only; EAP-SIM is not mentioned. Until a release is confirmed, build from a source tree that includes e415f81, or disable EAP-SIM.

## Timeline

- 2026-11-12T17:39:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-127029
- 2026-11-12T17:41:25+00:00 analyst — Read upstream commit e415f81 (EAP-SIM identity length, reported by Glen Saunders, 2026-09-16) and the FreeRADIUS security page. Fixed release and affected range unconfirmed: NVD page has no content, security page lists only the June 2026 issues, and 3.2.11 announcement mentions only TEAP/FAST. Linked commit 064567a is EAP-FAST (probably CVE-2026-127030), not this CVE. Nothing marked verified. Revisit when 3.2.11 release notes are available.

## Documents

- [fix] Patch: github.com https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9
- [fix] Patch: github.com https://github.com/FreeRADIUS/freeradius-server/commit/e415f818dcdf91626e5e7314b3a4f819ab11f572

## From the sources

A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_