CVE-2026-127030 · Package
NO FIX YET · SEE WHAT TO DO
FreeRADIUS has an improper length check in its EAP-FAST module that allows a stack-based buffer overflow while processing session tickets. A remote, unauthenticated attacker can send a crafted handshake request to crash the server process, causing a denial of service.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
FreeRADIUS servers with the EAP-FAST method configured and reachable by RADIUS clients. The maintainer says that if you do not use TEAP or FAST you are not affected. The exact affected versions and whether EAP-FAST is on by default are not stated in the sources read.
Not affected if eap-fast-disabled
Who cares eap-fast, freeradius, radius, self-hosted
3.2.11 once released (announced as upcoming on 2026-10-22; release not confirmed)A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.