{"id":"CVE-2026-127030","kind":"vulnerability","aliases":["CVE-2026-127030"],"related":[],"title":"FreeRADIUS: EAP-FAST length check flaw lets a remote attacker crash the server","description":"A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).","summary":"FreeRADIUS has an improper length check in its EAP-FAST module that allows a stack-based buffer overflow while processing session tickets. A remote, unauthenticated attacker can send a crafted handshake request to crash the server process, causing a denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["eap-fast","freeradius","package","radius","self-hosted"],"not_affected_if":["eap-fast-disabled"],"how_to_check":"- Run radiusd -v; versions before 3.2.11 (3.0.x and 3.2.x) should be treated as exposed until the vendor publishes an affected range.\n- Check whether EAP-FAST is enabled: grep -rn 'fast' /etc/freeradius/mods-enabled/eap (a 'fast {' block inside the eap module, and 'fast' in default_eap_type or the sites). If not used, the maintainer says you are not affected.","fix":"Upgrade to FreeRADIUS 3.2.11 once released (announced as upcoming on 2026-10-22; release not confirmed). Fix commits: 064567a, a5d09da on GitHub.","status":"open","published_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","triaged_at":"2026-11-12T17:39:49+00:00","updated_at":"2026-11-12T17:41:13+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-12T17:39:49Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"FreeRADIUS: EAP-FAST length check flaw lets a remote attacker crash the server","impact":"low","summary":"FreeRADIUS has an improper length check in its EAP-FAST module that allows a stack-based buffer overflow while processing session tickets. A remote, unauthenticated attacker can send a crafted handshake request to crash the server process, causing a denial of service.","audience":"businesses","category":"package","nicknames":[],"who_cares":["freeradius","radius","eap-fast","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Remote attacker crashes the RADIUS server process, causing denial of service","analyst_note":"Find the affected version range and fixed release from the linked patch pages on github.com and the NVD entry, and confirm whether EAP-FAST is enabled by default.","how_to_check":"- Check the installed FreeRADIUS version with `radiusd -v`\n- Check whether the EAP-FAST module is enabled in the `eap` configuration, for example `grep -r \"fast\" /etc/freeradius/`\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["eap-fast-disabled"],"who_is_affected":"Servers running FreeRADIUS with the EAP-FAST module enabled are exposed to the crash. The sources do not state the affected version ranges or whether the module is enabled by default, so teams should confirm both. Systems that do not run FreeRADIUS or do not enable EAP-FAST can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4558,"output_tokens":589,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version range and fixed release from the linked patch pages on github.com and the NVD entry, and confirm whether EAP-FAST is enabled by default.","search":"'-127030':17A,20A '-2026':16A,19A 'allow':43B,90C 'attack':11A,57B,104C 'base':47B,94C 'buffer':48B,95C 'caus':69B,116C 'check':6A,35B 'craft':61B,113C 'crash':12A,65B,121C 'cve':15A,18A 'denial':71B,126C 'dos':129C 'eap':3A,22B,39B,87C 'eap-fast':2A,21B,38B,86C 'exploit':106C 'fast':4A,23B,40B,88C 'flaw':7A,75C,108C 'found':77C 'freeradius':1A,24B,30B,79C 'handshak':62B,114C 'host':29B 'improp':33B,81C 'length':5A,34B,82C 'let':8A 'modul':41B,89C 'overflow':49B,96C 'packag':25B 'process':51B,68B,100C,119C 'radius':26B 'remot':10A,55B,102C 'request':63B,115C 'result':123C 'self':28B 'self-host':27B 'send':59B,110C 'server':14A,67B,118C 'servic':73B,128C 'session':52B,98C 'special':112C 'stack':46B,93C 'stack-bas':45B,92C 'ticket':53B,99C 'unauthent':56B,103C 'valid':83C","nicknames":[],"mitigations":[],"who_affected":"FreeRADIUS servers with the EAP-FAST method configured and reachable by RADIUS clients. The maintainer says that if you do not use TEAP or FAST you are not affected. The exact affected versions and whether EAP-FAST is on by default are not stated in the sources read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["eapfast","freeradius","high","package","radius","selfhosted"],"campaign_type":null,"search_a":"'-127030':17A,20A '-2026':16A,19A 'attack':11A 'check':6A 'crash':12A 'cve':15A,18A 'eap':3A 'eap-fast':2A 'fast':4A 'flaw':7A 'freeradius':1A 'length':5A 'let':8A 'remot':10A 'server':14A","search_b":"'allow':43B 'attack':57B 'base':47B 'buffer':48B 'caus':69B 'check':35B 'craft':61B 'crash':65B 'denial':71B 'eap':22B,39B 'eap-fast':21B,38B 'fast':23B,40B 'freeradius':24B,30B 'handshak':62B 'host':29B 'improp':33B 'length':34B 'modul':41B 'overflow':49B 'packag':25B 'process':51B,68B 'radius':26B 'remot':55B 'request':63B 'self':28B 'self-host':27B 'send':59B 'server':67B 'servic':73B 'session':52B 'stack':46B 'stack-bas':45B 'ticket':53B 'unauthent':56B","search_c":"'allow':90C 'attack':104C 'base':94C 'buffer':95C 'caus':116C 'craft':113C 'crash':121C 'denial':126C 'dos':129C 'eap':87C 'eap-fast':86C 'exploit':106C 'fast':88C 'flaw':75C,108C 'found':77C 'freeradius':79C 'handshak':114C 'improp':81C 'length':82C 'modul':89C 'overflow':96C 'process':100C,119C 'remot':102C 'request':115C 'result':123C 'send':110C 'server':118C 'servic':128C 'session':98C 'special':112C 'stack':93C 'stack-bas':92C 'ticket':99C 'unauthent':103C 'valid':83C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T17:17:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127030","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127030","severity":null,"published_at":"2026-11-12T17:17:43+00:00","modified_at":"2026-11-12T17:17:43+00:00","first_seen_at":"2026-11-12T17:39:39+00:00","fetched_at":"2026-11-12T17:39:39+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-127030:3757","url":"https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freeradius.org/message/4WZLJAYGIDCJTZ3GFPQ3CNRJSWGPFANX/","severity":null,"published_at":"2026-11-12T17:41:13+00:00","modified_at":"2026-11-12T17:41:13+00:00","first_seen_at":"2026-11-12T17:41:13+00:00","fetched_at":"2026-11-12T17:41:13+00:00","note":"Maintainer commit 064567a (2026-10-14, 'Fix possible stack overflow in EAP-FAST', found by Anthropic/Ada Logics) and list post by Alan DeKok (22 Oct) saying 3.2.11 'shortly' will include TEAP and FAST security fixes; not affected if EAP-FAST not used. No release page confirming 3.2.11 shipped, no affected range, and default-enabled status not confirmed; left unknown.","cites":["https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freeradius.org/message/4WZLJAYGIDCJTZ3GFPQ3CNRJSWGPFANX/"]}],"documents":[{"id":136855,"url":"https://github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":136858,"url":"https://github.com/FreeRADIUS/freeradius-server/commit/a5d09dad528d7a3a3c4c01158716ab85a12e09ef","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":137014,"url":"https://lists.freeradius.org/hyperkitty/list/freeradius-users@lists.freeradius.org/message/4WZLJAYGIDCJTZ3GFPQ3CNRJSWGPFANX/","title":"Release 3.2.11 and security fixes (Alan DeKok, 22 Oct 2026)","kind":"vendor","source":"analyst","publisher":null,"text":"We're going to be releasing 3.2.11 shortly. It contains a number of fixes for RadSec... The release will also include security fixes for TEAP and FAST. If you're not using those methods, then you're not affected.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}