CVE-2026-127030
Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length
CVE-2026-127030 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published November 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. No source names a fixed version.
- Severity
- 7.5 HighCVSS 3.1, CVE List
- Exploit chance
- 0.69%EPSS, 53rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeradiusUbuntu:Pro:16.04:LTS | All versions, plus listed versions 2.1.12+dfsg-1.3ubuntu52.2.8+dfsg-0.12.2.8+dfsg-0.1build12.2.8+dfsg-0.1build22.2.8+dfsg-0.1ubuntu0.12.2.8+dfsg-0.1ubuntu0.1+esm1 | None known |
freeradiusUbuntu:18.04:LTS | All versions, plus listed versions 3.0.15+dfsg-1ubuntu23.0.16+dfsg-1ubuntu23.0.16+dfsg-1ubuntu33.0.16+dfsg-1ubuntu3.13.0.16+dfsg-1ubuntu3.2 | None known |
freeradiusUbuntu:20.04:LTS | All versions, plus listed versions 3.0.19+dfsg-33.0.19+dfsg-3build13.0.20+dfsg-13.0.20+dfsg-33.0.20+dfsg-3build1 Show 4 moreShow less3.0.20+dfsg-3ubuntu0.13.0.20+dfsg-3ubuntu0.23.0.20+dfsg-3ubuntu0.43.0.20+dfsg-3ubuntu0.5 | None known |
freeradiusUbuntu:22.04:LTS | All versions, plus listed versions 3.0.21+dfsg-2.23.0.21+dfsg-33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu23.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.13.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.23.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.33.0.26~dfsg~git20220223.1.00ed0241fa-0ubuntu3.4 | None known |
freeradiusUbuntu:24.04:LTS | All versions, plus listed versions 3.2.3+dfsg-23.2.3+dfsg-2build23.2.3+dfsg-2build63.2.3+dfsg-2build73.2.5+dfsg-3~ubuntu24.04.13.2.5+dfsg-3~ubuntu24.04.23.2.5+dfsg-3~ubuntu24.04.3 | None known |
freeradiusUbuntu:26.10 | All versions, plus listed versions 3.2.8+dfsg-1ubuntu23.2.8+dfsg-1ubuntu43.2.10+dfsg-1ubuntu1 | None known |
freeradiusUbuntu:26.04:LTS | All versions, plus listed versions 3.2.7+dfsg-1ubuntu23.2.8+dfsg-1ubuntu13.2.8+dfsg-1ubuntu2 | None known |
What each source reports
CVE List Score used
Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
CVE-2026-127030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-12
EUVDEUVD-2026-124536
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
EUVD-2026-124536- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-12
GitHub AdvisoriesGHSA-6gv4-m6gx-m32r
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a...
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
GHSA-6gv4-m6gx-m32r- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-12
NVD
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
CVE-2026-127030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-13
OSV
Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
CVE-2026-127030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-14
OSVUBUNTU-CVE-2026-127030
A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).
- Record
UBUNTU-CVE-2026-127030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-13
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | NVD, OSV | |
| references | OSV | |
| published | EUVD | |
| published | EUVD | |
| aliases, references | GitHub Advisories, NVD | |
| cwes, products, references, severity, title | CVE List | |
| first indexed | EUVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
access.redhat.com/security/cve/CVE-2026-127030
bugzilla.redhat.com/show_bug.cgi?id=2572340
github.com/FreeRADIUS/freeradius-server/commit/064567a08f3b9d9b4863fab6060fafe296ac7de9
nvd.nist.gov/vuln/detail/CVE-2026-127030