Every CVE Search/ Get API key

CVE-2019-11235

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is...

9.8 CriticalFix available

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.57%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
CVE-2019-11235
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-345
Updated
2026-11-02
CVE List No score

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
CVE-2019-11235
Updated
2026-11-02
EUVDEUVD-2019-2934 No score

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
EUVD-2019-2934
Updated
2026-11-03
GitHub AdvisoriesGHSA-qx2m-p74g-xjwh 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is...

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
GHSA-qx2m-p74g-xjwh
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-345
Updated
2026-11-02
OSVALPINE-CVE-2019-11235 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
ALPINE-CVE-2019-11235
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
CVE-2019-11235
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSVDEBIAN-CVE-2019-11235 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
DEBIAN-CVE-2019-11235
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2019:1131 8.1

Red Hat Security Advisory: freeradius security update

Record
RHSA-2019:1131
CVSS 3.0
8.1 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVRHSA-2019:1142 8.1

Red Hat Security Advisory: freeradius:3.0 security update

Record
RHSA-2019:1142
CVSS 3.0
8.1 HighCVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-11235 9.8

FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid point on the curve being used" protection mechanism, aka a "Dragonblood" issue, a similar issue to CVE-2019-9498 and CVE-2019-9499.

Record
UBUNTU-CVE-2019-11235
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2019-0176 No score

Updated freeradius packages fix security vulnerability

An attacker can reflect the received scalar and element from the server in it's own commit message, and subsequently reflect the confirm value as well. This causes the adversary to successfully authenticate as the victim (CVE-2019-11234).

An invalid curve attack allows an attacker to authenticate as any user (without knowing the password). The problem is that on the reception of an EAP-PWD Commit frame, FreeRADIUS doesn't verify whether the received elliptic curve point is valid (CVE-2019-11235).

Record
MGASA-2019-0176
Updated
2026-11-02
OSVopenSUSE-SU-2019:1346-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
  • CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1346-1
Updated
2026-11-02
OSVopenSUSE-SU-2020:0542-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
  • CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2020:0542-1
Updated
2026-11-02
OSVSUSE-SU-2019:1039-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
  • CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
Record
SUSE-SU-2019:1039-1
Updated
2026-11-02
OSVSUSE-SU-2019:1086-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
  • CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
Record
SUSE-SU-2019:1086-1
Updated
2026-11-02
OSVSUSE-SU-2019:1181-1 No score

Security update for freeradius-server

This update for freeradius-server fixes the following issues:

Security issues fixed:

  • CVE-2019-11235: Fixed an authentication bypass related to the EAP-PWD Commit frame and insufficent validation of elliptic curve points (bsc#1132549).
  • CVE-2019-11234: Fixed an authentication bypass caused by reflecting privous values back to the server (bsc#1132664).
Record
SUSE-SU-2019:1181-1
Updated
2026-11-02
OSVUSN-3954-1 No score

freeradius vulnerabilities

It was discovered that FreeRADIUS incorrectly handled certain inputs. An attacker could possibly use this issue to bypass authentication. (CVE-2019-11234, CVE-2019-11235)

Record
USN-3954-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freeradius
Alpine:v3.10
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.11
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.12
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.13
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.14
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.15
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.16
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.17
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.18
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.19
 before 3.0.19-r0
3.0.19-r0
Show 80 moreShow less
Affected packages
PackageAffectedFixed
freeradius
Alpine:v3.20
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.21
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.22
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.23
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.24
 before 3.0.19-r0
3.0.19-r0
freeradius
Alpine:v3.6
 before 3.0.13-r3
3.0.13-r3
freeradius
Alpine:v3.7
 before 3.0.15-r4
3.0.15-r4
freeradius
Alpine:v3.8
 before 3.0.17-r3
3.0.17-r3
freeradius
Alpine:v3.9
 before 3.0.17-r5
3.0.17-r5
freeradius
Debian:12
 before 3.0.17+dfsg-1.1
3.0.17+dfsg-1.1
freeradius
Debian:13
 before 3.0.17+dfsg-1.1
3.0.17+dfsg-1.1
freeradius
Debian:14
 before 3.0.17+dfsg-1.1
3.0.17+dfsg-1.1
freeradius
Mageia:6
 before 3.0.15-1.1.mga6
3.0.15-1.1.mga6
freeradius
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-devel
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-doc
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-krb5
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-ldap
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-mysql
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-perl
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-postgresql
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-python
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-sqlite
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-unixODBC
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-utils
Red Hat:enterprise_linux:7::server
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-doc
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-krb5
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-ldap
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-mysql
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-perl
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-postgresql
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-python
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-sqlite
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-unixODBC
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius-utils
Red Hat:enterprise_linux:7::workstation
 before 0:3.0.13-10.el7_6
0:3.0.13-10.el7_6
freeradius
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-devel
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-doc
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-krb5
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-krb5-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-ldap
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-ldap-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-mysql
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-mysql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-perl
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-perl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-postgresql
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-postgresql-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-rest
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-rest-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-sqlite
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-sqlite-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-unixODBC
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-unixODBC-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-utils
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-utils-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:3.0.17-4.module+el8.0.0+3108+851cb559
0:3.0.17-4.module+el8.0.0+3108+851cb559
freeradius-server
SUSE:OpenStack Cloud 7
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server 12-LTSS
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server 12 SP1-LTSS
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server 12 SP2-LTSS
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Server 12 SP2-BCL
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Enterprise Storage 4
 before 3.0.3-17.12.1
3.0.3-17.12.1
freeradius-server
SUSE:Linux Enterprise Module for Server Applications 15
 before 3.0.16-3.3.1
3.0.16-3.3.1
freeradius-server
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius-server
SUSE:Linux Enterprise Software Development Kit 12 SP4
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius-server
SUSE:Linux Enterprise Server 12 SP3
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius-server
SUSE:Linux Enterprise Server 12 SP4
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius-server
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
 before 3.0.15-2.11.2
3.0.15-2.11.2
freeradius
Ubuntu:18.04:LTS
 before 3.0.16+dfsg-1ubuntu3.1, plus listed versions
3.0.15+dfsg-1ubuntu23.0.16+dfsg-1ubuntu23.0.16+dfsg-1ubuntu3
3.0.16+dfsg-1ubuntu3.1
freeradius-server
openSUSE:Leap 15.0
 before 3.0.16-lp150.2.3.1
3.0.16-lp150.2.3.1
freeradius-server
openSUSE:Leap 15.1
 before 3.0.16-lp151.4.3.1
3.0.16-lp151.4.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-11235 is a critical vulnerability (CVSS 9.8) in Freeradius, published April 16, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.57%, the 89th percentile. Fixed in freeradius 3.0.19-r0.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open